In a significant development for millions of affected consumers, U.S. District Judge John Milton Younge of the Eastern District of Pennsylvania has granted preliminary approval of a $117.5 million settlement resolving a class action lawsuit alleging that Comcast Cable Communications failed to implement adequate cybersecurity measures to protect customer data. The settlement marks an important step toward providing relief to the 31.6 million affected class members.
Lynch Carpenter partner, Gary Lynch, was court appointed as Co-Lead Class Counsel along with Norman Siegel of Stueve Siegel Hanson LLP. Mr. Lynch was also assisted in this case by Lynch Carpenter associate, Connor Hayes.
The Settlement Agreement
After arm’s-length negotiations between the parties under the supervision of retired U.S. Magistrate Judge Diane M. Welsh (Ret.), the parties reached a settlement agreement on December 23, 2025. The settlement establishes a non-reversionary cash settlement fund of $117.5 million to resolve all claims.
The settlement benefits to qualifying class members include:
- Three years of financial and credit monitoring and identity theft protection services (high-quality services provided by CyEx), and
- Cash compensation options consisting of either reimbursement of documented out-of-pocket losses (up to $10,000 per claimant), lost time (up to $150 per claimant) or an alternative fixed cash payment of $50.
Additionally, all settlement class members—even those who do not submit a claim form or enroll in CyEx’s paid monitoring services—will be entitled to utilize restoration services offered through CyEx throughout the entire duration of the service period.
The Underlying Case: October 2023 Cybersecurity Attack and Data Breach
On December 18, 2023, Comcast announced that it had been the victim of a third-party, criminal cyberattack between October 16, 2023, and October 19, 2023, in which the attackers were able to gain unauthorized access to customers’ personal information. The class action lawsuit here alleges that Comcast failed to properly protect personal information in accordance with its duties, had inadequate data security, was unjustly enriched by the use of personal data of the impacted individuals, violated the federal Cable Act, 47 U.S.C. § 521 et seq., violated certain state consumer statutes and other laws, and improperly or inadequately notified potentially impacted individuals. Comcast denies that it engaged in any wrongdoing or violated any law and denies liability.
The data compromised in this data breach included some combination of:
- Usernames and passwords
- Full names and contact information
- Last four digits of Social Security numbers
- Dates of birth
- Secret questions and answers
The breach affected former and current customers residing in the United States and its territories. Comcast sent individual notifications to affected customers in December 2023.
Final Approval Hearing
A Final Approval Hearing is scheduled for August 5, 2026, at 12:30 P.M. at the James A. Byrne Courthouse, Courtroom 15-B, 601 Market Street, Philadelphia, PA 19106.
Claims Submission
To receive compensation, class members must submit a Claim Form online at https://comcastbreachsettlement.com by September 14, 2026, or mail a completed paper Claim Form (included with their notice of settlement), postmarked no later than September 14, 2026.
More information
Additional information about the settlement is available on the Settlement Website at https://www.comcastbreachsettlement.com/
Case Citation
Hasson v. Comcast Cable Communications LLC, et al., No. 2:23-cv-05039-JMY (E.D. Pa.)