Xfinity was impacted by a data security incident.
To learn about what we’re doing to mitigate the issue and protect our customers, click here.
Posted Dec 18, 2023, 10:14 PM UTC
3575
I called it when they reset everyone's password a couple weeks ago and acted like it was just because that's a nice thing to randomly decide to do to everyone's account at the same time for no particular reason.
They could've at least been up-front about the reasons when they made that post 2 weeks ago, but Reuters says Comcast knew about the breach since October 25!
44
That's goddamn ridiculous. They tell us NOW after all this time.
1
You might want to edit your second word, before the mods remove your comment. Despite being a rightful expression of frustration with this situation, Comcast likes to remove any 'naughty' words in this subreddit.
2
The memo linked at the top of the website also says stuff like the LAST FOUR DIGITS OF OUR SSNs were also stolen.
1
Class action lawsuit in the making?
1
Removed due to Rule #5 Solicitation: Soliciting others to participate in any type of specific action such as class action lawsuits or other calls to action is prohibited within our subspace.
1
I had to reset my password on December 22nd. Why did it take that long for them to reset me? I was able to log in with the old password the whole time up until then when I was trying to connect to a hotspot.
1
I looked through everything. Customer Service gets worse by the month.
13
And yet they want my bank account info for my discount?
11
I refused to give it to keep it, and this is precisely why. This is the second time now my information has been compromised thanks to xfinity, no way I was handing over any banking information to them
6
Hi u/MeredithInTX, I understand your concern with the discount, and I'd like the opportunity to check into that for you. To get started, please send us a modmail https://www.reddit.com/message/compose?to=%2Fr%2FComcast_Xfinity with your name and the name of the account holder if different, and the full service address including city, state and zip code.
-3
Why didn’t I get an email with this information? Why am I learning about this on Reddit?
8
I didn't get an email either. I logged in to my comcast account to check on when my 12-mo commitment was up & it made me change my password. I was notified at that point in time -- and after I read and clicked through that bit of news, I then encountered the pop-up telling me of a rate increase.
So let me get this straight:
- As per their own admissions, they took 10 days to apply a software patch and let 36m customer's private information go out the door.
- They recommend checking your credit score (which you can do free annually!) . At the point my credit score has been negatively affected, I'll already have been compromised. This statement is utterly worthless - and is insultingly stupid.
- No offer of free credit monitoring - which is something that could actually be of use to all of us affected.
- I contacted the phone no for IBX -> the company XFinity has contracted to handle customer support on this data breach. I sat on hold for hours before I pressed "1" for them to do a call-back -- which then never happened. I'm guessing IBX is of the same quality of Xfinity's security team.
- And they then still decide that "yes, we should absolutely continue forward with announcing rate increases right now".
Wow --> who runs this company? Are they complete morons (don't answer -> we already know). My 12-mo commitment is up in March -- and lucky me, I've got a new fiber internet company that just moved into the area. No data caps, $90/mo for 1gb service. Not a huge bargain, but considering that Xfinity was boning me for $93/mo for 800mps while leaving their my personal info exposed, this is a no-brainer.
2
I was prompted on Dec. 23 or 24 to reset my password when trying to sign in to my account, but I hadn't received an email from Xfinity about anything either, or so I thought. I was just checking my spam folder, and see I received an email from "Xfinity" using the email address "[email protected]" (as opposed to an email with an "xfinity" or "comcast" domain) on Dec. 21 that has all the information about the security situation that everyone else has mentioned previously, whether seeing it in an email or some PDF. So, I found that odd and wasn't sure what "idx" is and why that was the entity sending the notice. Anyway, just thought I'd mention that in case anyone might want to check their junk/spam folders for an email about it.
2
I finally got an email "Notice of Data Security Incident" about 1.5 hours ago (though it went to the Gmail spam folder).
2
After I went through the reset procedure, I asked the person online about a data breach. They said I should call the customer service representative. I did so and was told there was no breach. The reset, they said, was just a courtesy and a request for backup contact info.
So that was a flat out lie?
6
I'd guess that the front-line support reps either were not told the truth by their bosses, or were told the truth but told they'd be fired if they revealed it to a customer before PR/legal finished writing the official statements.
3
Generally the simplest answer is the right one.
When it's a front line team member, especially one based in a vendor in a foreign country, assume they werent briefed on the information / had no resources for it and therefore assumed it was a standard account takeover.
3
Yeah, not the low level support tech's fault. This is 100% a (mis)management issue.
1
Agreed. When I contacted tech support the day the news broke (after I couldn’t get to the admin site to change my gateway password), the CSR had no idea about the data breach. I ended up consoling them bc I know from experience how much abuse they were going to get from customers. The CSR was beyond grateful just bc I was sympathetic. Front-line support is not a job for the faint of heart.
1
Xfinity is scum and I cannot wait until my power company completes its fiber build out so I can leave this company in a ditch like they deserve
6
My old electric provider did that. Pricing and customer service were very good and transparent. Electric companies are used to being regulated like a utility, generally speaking, they are carrying that same mindset over to their fiber roll out. Hopefully more electric providers go this route. Comcast is on its way out.
2
PG&E vs Xfinity fight!
1
Yup. All of a sudden my email was locked and I couldn't get in. I tried for days and finally just today got in. I was getting all different kinds of the run around and stories. Horrible. Just be honest and help everyone fix it..
5
Why are you using Xfinity for your email? Just use a better email carrier like Gmail
12
That is a good idea long-term, but switching years of accounts/contacts/etc is a lengthy process (which many people don't want to bother with until they have to), and a lot harder if you don't currently have access to the previous email address.
4
The thing is you can set up email forwarding, and export your contacts list to gmail as well. No more than 30 minutes of time spent and you're up and running.
3
True but getting users to change is a different thing. I’ve been trying to move my mom off yahoo for years but she refuses.
1
Better to separate email and ISP preemptively since if one has to move, they might have to change ISP as well and then have to deal with the physical move and the email change at the same time.
1
It's a lengthy process, but do you want to be held hostage by Xfinity? My parents are literally using Xfinity only because of the email even when AT&T fiber is in their neighborhood.
A good digital setup takes effort no doubt, just like using a password manager for every login takes time, but it's better to do it now than to be stuck on an ISP only because you can't move emails.
1
c
You can keep your Xfinity email still I think. (or at least years ago you could for sure) You just have to actively use the email account at least once a month.
1
What makes them better?
1
Gmail offers 10+ gigabytes for each account. It also works very well with other google services.
You also don't have to rely on Xfinity's slow website at all! It's usually instantly loaded.
Thirdly, you can also add extensions on your browser like "Checker plus for gmail" to really get more out of your experience! I use it daily and it keeps me aware of any new emails as quick as possible.
Oh, and gmail has phishing and advanced spam filters to help get rid of all the scammy emails as quick as possible.
2
You should never use your ISP for email. Right now I'm stuck with Netzero and paying them $20 per year. Why? Because I was a dumb kid in the 90s who thought free internet service was cool and used them for all my emails instead of yahoo or hotmail. Then when I quit using Netzero as an ISP I suddenly realized my mistake, then they started charging for email, then they started raising the price, and now I'm stuck with it for life. They only started using encryption and IMAP about 3 years ago. Before that my email was constantly getting hacked because anyone could see my password when on the same network.
1
My email was working fine (via IMAP), I didn't find out that I had to change my password until I tried to log in to their website.
1
Extremely poor communication on an issue that is likely to negatively affect millions of people.
5
Why wasn’t this proactively communicated? I should’ve received an email, a letter, an automated phone call… the fact that I’m finding out about this in a Reddit post is corporate incompetence in the highest order.
5
Reuters did also pick up on it late Monday afternoon, so it might be in newspapers and on TV news shows tomorrow. Still no emails from Comcast about this as of Monday night, though.
3
Ya we already figured it out with the mass password reset. How about fixing the data usage page one of these days so I don't go over and get charged for it??
5
So glad I cancelled service in November, never to return again.
3
Your data could still be part of the breach, since it happened in October.
8
“We strongly encourage you to enroll in MFA.” That’s good as far as it goes, but that would not have prevented this breach nor the breach they had about a year ago where it appears threat actors got hold of an admin account and disabled MFA.
3
I have 5 Comcast email addresses. Received a notification to one of them. Very odd.
3
"First time?" 😂
3
And this is precisely why I use a password manager.
3
I should just invest in one. But what will the password be for my password manager login? What if that gets hacked. NOTHING IS SAFE.
1
Password managers are generally much safer than these typical login systems. They're designed to be secure. It would behoove you to choose a strong password, but some managers like 1Password basically have entropy built in where even if you use a weak password, their mandated use of a secret key--basically a randomly generated 128 bit key ensures that even "hunter2" paired with that key will be more than sufficient to deter attackers.
This was an interesting strategy I hadn't thought of and I instead forced myself to learn some 15+ random character password when I first started using password managers. I do also think the fact that password managers use zero knowledge encryption and generally have strong hashing routines to slow down brute force attacks, it makes most password managers better than pretty much every online login system. Take for instance 1Password and even LastPass. Both offer something like 100k rounds of hashing. So let's just say you use a weak password that can get hacked in 1 minute of brute force trials. By mandating 100,000 rounds of hashing your weak password now takes 69 days to crack instead. That's huge. This kind of computational power required to crack passwords makes it very unlikely anyone will even bother with you unless you're some A-list celebrity that's worth hacking.
2
I stopped trusting LastPass after their string of security breaches last year.
1
[removed]
1
Your comment in r/Comcast_Xfinity has been removed under Rule #2: Profanity & Inappropriate Language — We understand that working with any company can be frustrating, especially once you've had a negative experience however, we ask that users please use appropriate language when engaging in our community. This includes abbreviated or otherwise colorfully censored profanity as well. If you feel your comment was removed in error, please contact the moderators.
As always, remember the human behind every username.
Thank you for understanding.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
Such as LastPass?
1
LastPass is better than no password manager IMO but they’ve had a few security issues in the past year. I’ve used LP personally for almost 10 years before jumping ship to 1Password. Been happy with the switch, but LP isn’t that bad of a product some people make it out to be. I’d rather people use a password manager than just password reuse.
1
My vote is for 1Password. My family uses it, I try to get my clients to use it, it's fantastic. And their cross-platform support is second to none!
1
As soon as fiber comes in a couple months i'm ditching the heck out of xfinity. greedy sneaky bastards.
2
What other companies did this affect? Answers to security question is a huge leak?
2
Windstream forced everyone to change their passwords a few days ago. (They handled it perhaps even worse than Comcast -- they sent everyone an email, but disabled email access if you didn't change your password within 48 hours. Since I don't use them as my primary email account since I got Comcast, that was a lot of fun. Even moreso since their webmail server suddenly doesn't support Firefox and I don't support Google or Microsoft...)
They did NOT say there was a breach, only that they were "taking measures to make everyone's email more secure" or words to that effect. But the timing is terribly suspicious.
1
Apparently Boeing, Toyota, Industrial and Commercial Bank of China, and some law firms plus government agencies. Google 'Citrix Bleed'--looks like that's what the exploit was. I'm guessing Comcast is just the largest pool of customers which is why news outlets picked it up.
Citrix is about to have the worst start to a new year I feel.
1
yes and i had to pay a computer guy to come over and fix your software so i could loginto Xfinity acct; you really made a new mess of it.
2
Why am I first hearing about this in a reddit post, instead of you proactively letting your customers know that they their information was stolen, and letting them know WHAT information was stolen?
Disgusting corporate behavior.
From working in corporate tech support, being transparent and honest about things gets you in trouble with your boss. In all my 15 years of IT I jave never worked anywhere where they allowed us to tell them straight up when a system is broken, or when something went wrong. It's always like this, some song and dance, office politics, and endless framing.
Very on brand for Comcast.
As a long-ago Comcast ad campaign said, "Have a Comcastic day!"
Lol they forced me to create a new password to log into my xfinity apps. That was pretty proactive if you ask me
yeah me too.sick bunch.
Lots of people, myself included, I rarely login to Xfinity. That prompt to reset also says nothing about a data breach. People's banking info was leaked. Partial SSNs. That's something that custumers need to know asap. Xfinity knew since November 16 by their own testimony. I didn't get a single email or text about this despite them emailing and texting me every month that my bill is ready.
That is not "proactive". That is below the bare minimum in my opinion.
They knew in October.
I received an email about it this morning from Comcast (via IDX, their incident response provider) at an email address I've never given to Comcast, but not at the actual email address associated with my Comcast account.
I hope you didn’t tap any links, if there was one.
This is true. I knew nothing about this. I so agree, disgusting.
Most people kinda put two and two together when they were forcing everyone to reset their PWs lol it was just a matter of waiting for the eventual announcement
idk about anyone else but I got an email about a half hour before this or their other social media posts, then it was all over the news
Which is still a month late. Xfinity knew over a month ago.