We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 to review VPN services and cover privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 to review VPN services and cover privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

Massive Xfinity Data Breach Affects 32 Million Customers

Massive Xfinity Data Breach Affects 32 Million Customers
Zane Kennedy Published on 24th December 2023 Former Cybersecurity Researcher

Comcast, the parent company of Xfinity, has confirmed a massive data breach impacting nearly 36 million customers following the exploitation of a critical vulnerability in Citrix software.

The vulnerability, termed "CitrixBleed" and identified as CVE-2023-4966, was first announced by Citrix on October 10, 2023, and has since been used in a global wave of cyberattacks targeting major corporations and institutions.

The US telecommunications giant detected the breach on October 25, 2023, revealing unauthorized access to its internal systems between October 16 and 19, 2023. This followed Citrix's release of security updates to patch the critical vulnerability. Despite Xfinity's prompt implementation of these patches, the hackers exploited the short window before the fix to gain access to sensitive customer data.

Upon discovering the breach, Xfinity immediately notified federal law enforcement and commenced a thorough investigation. By November 16, 2023, Xfinity acknowledged that the attackers had likely acquired customer data. Further analysis concluded on December 6, revealing that compromised data included usernames, hashed passwords, and, in some cases, names, contact information, the last four digits of social security numbers, dates of birth, and secret questions and answers.

In response to the incident, Xfinity has mandated a password reset for all affected accounts and strongly recommended customers to enable two-factor or multi-factor authentication — a security measure already adopted by many Xfinity users. The company has also advised customers against using the same passwords for multiple accounts, urging them to change passwords for other services where the same credentials are used.

The breach's impact is significant, considering Comcast's reported customer base of over 32 million. This incident not only raises concerns about data security in large corporations but also highlights the persistent threat of cybercriminals exploiting vulnerabilities in third-party software.

Comcast has assured users that it continues to prioritize customer data protection, investing in advanced technology, protocols, and cybersecurity expertise.

About the Author

Zane was a Cybersecurity Researcher and Writer at vpnMentor. His extensive experience in the tech and cybersecurity industries provided readers with accurate and trustworthy news stories and articles. He aimed to help individuals protect themselves through informative content and awareness of cybersecurity's crucial role in today's digital landscape.

Please, comment on how to improve this article. Your feedback matters!

Leave a comment

Sorry, links are not allowed in this field!

Name should contain at least 3 letters

The field content should not exceed 80 letters

Sorry, links are not allowed in this field!

Please enter a valid email address