# Xfinity breach via Citrix Bleed: 35.9M customers · pwn.watch

> Comcast's Xfinity said attackers used Citrix Bleed (CVE-2023-4966) on its NetScaler devices between Oct 16 and 19, 2023, before mitigation, and took usernames and hashed passwords. Some customers also lost names, contact details, last four SSN digits, birth dates and security questions. A Maine filing put the count at 35,879,455.

Page: https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023 · generated 2026-10-22T20:15:47.501Z

## Status
- Severity: high · status: closed · patch: patched
- Product: Xfinity (Comcast)
- Started: 2023-10-16 · closed: 2023-12-18

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023/feed.xml
- JSON Feed: https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023.json
- This file: https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023/llms.txt

## Updates (newest first)
- 2023-12-18: Public notice; customers are forced to reset passwords (https://www.theverge.com/2023/12/18/24007082/xfinity-data-breach-hack-notice-citrix)
- 2023-12-06: Xfinity concludes usernames and hashed passwords were taken
- 2023-11-16: Xfinity determines customer information was likely acquired
- 2023-10-16: Unauthorized access to Xfinity internal systems begins (through Oct 19), per Xfinity's notice (https://assets.xfinity.com/assets/dotcom/learn/Notice%20To%20Customers%20of%20Data%20Security%20Incident.pdf)

## Fix brief
# Security brief: Xfinity breach via Citrix Bleed: 35.9M customers

Source: https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023 · status: closed (closed Dec 18, 2023) · severity: high · updated Dec 18, 2023

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Comcast's Xfinity said attackers used Citrix Bleed (CVE-2023-4966) on its NetScaler devices between Oct 16 and 19, 2023, before mitigation, and took usernames and hashed passwords. Some customers also lost names, contact details, last four SSN digits, birth dates and security questions. A Maine filing put the count at 35,879,455.

Severity detail: Data breach of 35.9M customer records via an unpatched-in-time Citrix Bleed device

- Product: Xfinity (Comcast)

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Dec 18, 2023: Public notice; customers are forced to reset passwords
- Dec 6, 2023: Xfinity concludes usernames and hashed passwords were taken
- Nov 16, 2023: Xfinity determines customer information was likely acquired
- Oct 16, 2023: Unauthorized access to Xfinity internal systems begins (through Oct 19), per Xfinity's notice

## Advisories
- [Notice To Customers of Data Security Incident](https://assets.xfinity.com/assets/dotcom/learn/Notice%20To%20Customers%20of%20Data%20Security%20Incident.pdf) (Xfinity)

## Write-ups & news
- [Comcast Xfinity data breach affects over 35 million people](https://www.theverge.com/2023/12/18/24007082/xfinity-data-breach-hack-notice-citrix)
- [Xfinity notifies its customers of data breach linked to software vulnerability](https://apnews.com/article/xfinity-data-breach-customer-information-bfe6d266df1c3570f7f9005c8bb9cfed)

## Caveats
Related: citrix-bleed-netscaler-cve-2023-4966.

---
Machine-readable: https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.