A $117.5 million settlement over a 2023 cyberattack on Xfinity is paying former and current Comcast customers a flat sum of about $50 with no receipts or paperwork required, and the window to file runs until September 14, 2026. The breach exposed personal data belonging to roughly 31.6 million customers, and the agreement sets aside a much larger payout for anyone who can document identity-theft losses tied to it. The flat payment is the reason the case is drawing attention: it asks almost nothing of the person filing, yet the deadline is real and passing it forfeits the money.
What the $117.5 million Xfinity settlement pays
The breach traces to late 2023, when attackers exploited a software vulnerability and reached information that Comcast held on tens of millions of Xfinity accounts, including names, contact details, and in some cases partial Social Security numbers and security questions. The class-action settlement that followed does not require a customer to prove any harm to collect the base amount. Settlement trackers reporting the terms note that eligible customers can claim a flat cash payment of roughly $50 simply by filing before the deadline, with no documentation asked for at all.
People who suffered actual losses are treated differently and far more generously. Documented, out-of-pocket costs traceable to the breach can be reimbursed up to $10,000, and the settlement also covers lost time at a rate of $30 an hour for as many as five hours spent dealing with the fallout. Class members can additionally enroll in three years of credit monitoring, a benefit that matters more to older account holders, who are disproportionately targeted once their data circulates.
Free retirement updates: Every year, billions in settlements and unclaimed money go unclaimed. The free Retirement Shield newsletter sends the real ones, with deadlines, a couple times a week. Get the free newsletter.
Who qualifies and how the claim gets filed
Eligibility centers on whether a person’s information was among the records the attackers accessed. The court-appointed claims administrator, Kroll, is notifying identified class members, but customers who believe they were affected and did not receive a notice can still check their status and submit a claim directly. The official process runs through the settlement’s claims site, where the flat-payment option and the documented-loss option live side by side on the same form.
Choosing the documented-loss path means attaching evidence: bank or card statements, police or fraud reports, or records showing money spent resolving unauthorized activity. The flat payment asks for none of that, which makes it the realistic choice for the many customers who never saw a fraudulent charge but were still swept into the breach. What both paths share is the same hard cutoff, and a claim filed even a day after September 14, 2026 does not qualify.
Filing does not produce an instant deposit. After the claim window closes, the administrator reviews submissions, resolves disputes over eligibility, and waits out any appeals of the settlement before releasing funds, a process that commonly stretches months past the deadline. A claimant who files correctly and then hears nothing for a while is seeing the normal pace of a class-action payout, not a sign of a problem, and the choice between a mailed check and an electronic payment is made on the claim form itself.
Payment amounts can shift with the volume of valid claims. When a large share of a settlement’s eligible pool files for the flat sum, per-person payouts sometimes shrink on a pro-rata basis, and when few file, they can rise. That uncertainty is not a reason to skip filing; it is a reason to file early rather than assume the roughly $50 figure is fixed. The number is an estimate the administrator publishes, not a guaranteed check.
The catch that costs claimants the money
Large consumer settlements share a predictable failure point: eligible people ignore the notice, mistake it for junk mail, or assume the payout is too small to bother with, and the deadline quietly passes. A separate tracker of open data-breach settlements shows how routinely these windows close with a fraction of the affected class having ever filed, leaving unclaimed funds on the table. For a household on a fixed income, a no-documentation payment is close to found money, and the only cost of collecting it is a few minutes before the cutoff.
A second risk sits alongside the first. Any settlement that generates real payouts also generates imitators, and scammers routinely spin up look-alike claim sites or send emails demanding a fee or bank login to release the funds. The genuine Comcast settlement never charges to file and never requires an upfront payment to collect. Anyone contacted with a demand for money or account credentials in the name of this settlement is looking at fraud, not the administrator.
The clean version of this story is short: the breach was real, the money is real, the deadline is real, and the flat claim is easy. What decides whether a customer collects is not eligibility but attention, because the funds revert or shrink for everyone who lets September 14 slip by without filing.
This article was produced with AI assistance and reviewed by The Money Overview editorial team.
More Financial Reading
