A cybersecurity breach at Comcast may have exposed the personal data of 35.9 million Xfinity customers, the Philadelphia-based telecom giant revealed.
In a letter sent to impacted customers Monday, the company said hackers infiltrated their internal systems and gained access to customers' usernames and hashed passwords sometime between Oct. 16 and 19. Hashed passwords are encrypted versions stored on Comcast's servers; the encryption is a precaution that makes it difficult for hackers to determine users' actual passwords.
- READ MORE:
- Cyberattack on Hershey Company left hackers with access to personal data
- Hackers in ransomware attack on Philly-area hospitals post patient data for sale on dark web
- Ransomware cyberattack disrupts hospitals and clinics in Pennsylvania, four other states
Comcast still is recommending that its Xfinity customers reset their passwords and turn on multi-factor authentication as an additional security step for their accounts. The company also advised customers who were part by the breach to check their credit reports and financial statements for unusual or unauthorized activities.
An undisclosed number of those customers may have also had other personal information exposed, including their names, contact information, dates of birth, the last four digits of their Social Security numbers and the answers to security questions used to verify users' identities when to logging in to Xfinity's website or mobile app.
Federal authorities have been notified about the breach, and Comcast is continuing to investigate, performing its own "data analysis" related to the incident, the company said.
"We are not aware of any customer data being leaked anywhere, nor of any attacks on our customers," a Comcast spokesperson told Variety.
The company is blaming the data breach on a security vulnerability in a third-party software platform from cloud computing provider Citrix that is used by Comcast internally. Although the vulnerability was patched several days after it was detected on Oct. 10, Comcast said they later discovered that there had been "unauthorized access to our internal systems" before the Citrix security flaw was addressed.