Comcast has confirmed a security breach affecting 36 million U.S. Xfinity accounts, according to media reports.
Comcast said that hackers exploited a vulnerability in third-party software provider, Citrix, which it uses for remote network access, according to a December 19 Wall Street Journal (WSJ) report.
The breach occurred between October 16 and 19, exposing usernames, hashed passwords, names, contact information, birth dates, the last four digits of users’ social security numbers and secret questions and answers, WSJ said.
Sign up for Kiplinger’s Free E-Newsletters
Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.
Profit and prosper with the best of expert advice - straight to your e-mail.
The company joins a long list of well-known brands hit by cyber attacks this year, including genetic testing company 23andMe, which earlier this month disclosed a data breach affecting 6.9 million users.
On October 10, the week before Comcast’s breach, Citrix published an advisory on its website about two vulnerabilities in its systems. According to an October 27 report from cybersecurity firm Rapid7, the two vulnerabilities allow “an attacker to read large amounts of memory after the end of a buffer,” that in turn would allow a bad actor to “impersonate another authenticated user.”
Citrix released a software update to fix the vulnerability on October 23. It also noted that it received reports of session hijacking and targeted attacks exploiting the vulnerability.
“We are not aware of any customer data being leaked anywhere, nor of any attacks on our customers,” a Comcast spokesperson told the WSJ in the report. He added that the company is requiring customers to reset their passwords and recommends enabling multi-factor authentication.
How to secure your Xfinity account
If you're an Xfinity customer, you’ll want to follow the company’s guidance and immediately change your password. Experts recommend choosing a secure, easy-to-remember password, such as a nonsensical combinations of symbols, numbers and upper-and-lower-case numbers.
Experts also encourage people to strongly consider enabling multi-factor authentication, just as Comcast has recommended for its customers.
To do this for your Xfinity account, download the company's app, which the company says is available for download on Apple and Android phones. Then follow these steps. You will then be able to approve or deny log-in attempts with a yes/no button push, facial recognition, one-touch fingerprint ID, traditional text message or email codes, or a code generator.
Related Content
-
Stock Market Today: Stocks Rally Despite Rising Geopolitical TensionThe main indexes were mixed on Tuesday but closed well off their lows after an early flight to safety.
-
What's at Stake for Alphabet as DOJ Eyes Google's ChromeAlphabet is higher Tuesday even as antitrust officials at the DOJ support forcing Google to sell its popular web browser. Here's what you need to know.
-
Visa, Mastercard's Swipe Fee Settlement Might Save You Money, For NowThe limited-time agreement directly benefits merchants, which can potentially pass savings on to consumers.
-
New List Out On Medicare Part B Drugs Eligible for RebatesSome Medicare beneficiaries may pay lower coinsurance rates from April 1 to June 30 for the drugs, HHS says.
-
Use An iPhone? You May Be Hearing From A Class-Action Lawsuit GroupA handful of suits against the iPhone maker seek to crack down on everything from app store purchases to messaging.
-
Capital One/Discover: What's In Their Wallet For You?Push back on Capital One's planned merger with Discover is growing with one group of consumer advocates calling for a public hearing.
-
Lawmakers: Nix Social Security Offsets For Seniors In Student Loan DefaultOffsetting Social Security benefits to pay for defaulted student loans can be devastating for some beneficiaries, lawmakers say.
-
Stellantis Recalls 285K Vehicles Over Airbag ProblemsDefective airbag inflators on certain Chrysler and Dodge vehicles could rupture and cause injury or death, NHTSA says.
-
HHS Funding Secured As Major Government Shutdown AvoidedWith passage of the fiscal 2024 appropriations package, Medicare and Social Security are among the key agencies to receive funding through September 30.
-
State Farm To Exit Homeowner Renewal Policies in CaliforniaState Farm plans to send non-renewal notices to 72,000 home and apartment policyholders starting this July.
