WASHINGTON — Xfinity customers could be eligible for cash and identity theft monitoring after Comcast agreed to pay $117.5 million to settle a class action lawsuit stemming from a 2023 cyberattack that exposed the personal information of tens of millions of Xfinity customers, according to court documents.

The proposed settlement, pending approval in the U.S. District Court for the Eastern District of Pennsylvania, would resolve claims that Comcast failed to adequately protect customer data after hackers exploited a vulnerability in Citrix software between Oct. 16 and Oct. 19, 2023. The company disclosed the breach in December 2023.

The attack affected an estimated 35.8 million customers — more than the company’s entire broadband subscriber base at the time — exposing usernames, hashed passwords, and in some cases the last four digits of Social Security numbers, contact information, and security questions and answers.

Comcast denies any wrongdoing or violation of the law. 

Customers who received a breach notification from Comcast are automatically included in the settlement class.

Eligible customers can file a claim for reimbursement of documented out-of-pocket losses — such as costs related to identity theft, credit monitoring services or credit freezes incurred after Oct. 16, 2023 — up to a cap of $10,000. Customers who spent time dealing with fraud or taking preventative measures can also claim up to five hours of lost time at $30 per hour.

Those without documented losses can opt for an alternative cash payment of around $50, though that amount may be adjusted up or down depending on how many claims are filed.

All settlement class members are also automatically eligible to enroll in three years of identity protection services, which include credit monitoring, dark web monitoring, up to $1 million in identity theft insurance, and access to fraud specialists.

The deadline to file a claim is Aug. 14. 

Claims can be submitted online at www.comcastbreachsettlement.com or mailed to the settlement administrator, Kroll Settlement Administration LLC. Customers will need to provide a unique Class Member ID that was sent via email or can be looked up online. 

The court is scheduled to hold a final approval hearing on July 7.

Customers who do nothing will remain part of the settlement class, give up their right to sue over the breach, and will not receive a cash payment — but will still be able to enroll in the identity protection services once the settlement is finalized.

For more information or to file a claim, visit the settlement website or call (833) 319-2401.