According to Comcast, nearly 36 million Xfinity customers had their personal information compromised when hackers took advantage of a security hole.
Major enterprises often use Citrix networking equipment, and since late August, hackers have been taking advantage of a flaw known as “CitrixBleed” in it. Despite Citrix making the patches available in early October, many organizations failed to implement them. Several prominent organizations have fallen prey to it, including Boeing and a prominent bank in China.
The cable television and internet business of Comcast, Xfinity, was the most recent target of CitrixBleed. The telecommunications behemoth warned consumers that “malicious behavior” was not detected until October 25th, despite hackers gaining access to its internal systems from October 16th to the 19th via the CitrixBleed vulnerability.
The Xfinity team had already established by November 16 that the hackers had “likely gotten” “information,” and by December, they had also discovered that this data contained sensitive customer information, such as usernames and “hashed” passwords (passwords that are stored in a manner that renders them unreadable to humans). Since specific weaker hashing methods are susceptible to cracking, it is unclear how or with what algorithm the passwords were scrambled.
According to the business, hackers may have obtained sensitive information, including names, dates of birth, contact details, secret questions and answers, and the last four digits of Social Security numbers, for an undetermined number of clients.
Upwards of 32 million internet users were amongst Comcast’s most recent financial report, which suggests all of their customers were affected by the hack.
How the event has affected the company’s operations, whether Xfinity has been demanded ransom, or whether the issue has been reported to the U.S. Securities and Exchange Commission following their new data breach reporting regulations are all unknown.
Although not required by default, Xfinity recommends that all customers use two-factor or multi-factor authentication and mandates that consumers change their passwords.
