https://pwn.watch/t/xfinity Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Mon, 18 Dec 2023 00:00:00 GMT https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023 https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023 Mon, 18 Dec 2023 00:00:00 GMT high <p>Comcast's Xfinity said attackers used Citrix Bleed (CVE-2023-4966) on its NetScaler devices between Oct 16 and 19, 2023, before mitigation, and took usernames and hashed passwords. Some customers also lost names, contact details, last four SSN digits, birth dates and security questions. A Maine filing put the count at 35,879,455.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched</p> <p><strong>Latest updates:</strong></p><ul><li>2023-12-18: Public notice; customers are forced to reset passwords (<a href="https://www.theverge.com/2023/12/18/24007082/xfinity-data-breach-hack-notice-citrix">source</a>)</li><li>2023-12-06: Xfinity concludes usernames and hashed passwords were taken</li><li>2023-11-16: Xfinity determines customer information was likely acquired</li></ul>