Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Data Breaches

Xfinity Customer Data Compromised in Attack Exploiting CitrixBleed Vulnerability

Comcast’s Xfinity says customer data, including credentials, were compromised in an attack exploiting the CitrixBleed vulnerability

Xfinity data breach

Comcast’s Xfinity is informing customers that their information has been compromised in a cyberattack that involved exploitation of the vulnerability known as CitrixBleed.

CitrixBleed, officially tracked as CVE-2023-4966, is a critical vulnerability affecting Citrix’s Netscaler ADC and Gateway appliances. Malicious actors can exploit the flaw to hijack existing sessions, which can give them access to the targeted organization’s systems. 

Patches were announced by Citrix on October 10, but the vulnerability had been exploited as a zero-day since August. Mass exploitation of CitrixBleed was underway a few weeks after the patch was announced, and reports started emerging about its use in attacks aimed at major companies

In Xfinity’s case, the telecommunications and smart home solutions provider said it “promptly patched and mitigated” the vulnerability within its systems. However, it discovered on October 25 during a routine cybersecurity exercise that CitrixBleed had been exploited against its systems, with hackers having access between October 16 and 19. 

An investigation revealed on November 16 that information had likely been stolen by the attackers. While the analysis is ongoing, Xfinity determined on December 6 that customer information such as usernames and hashed passwords have been compromised. 

For some customers, information such as name, contact details, date of birth, last four digits of social security number, and security questions and answers may have also been stolen.

Xfinity is now notifying customers and requiring them to reset their passwords. The company is also advising them to ensure that multi-factor authentication is enabled on their account.

The CitrixBleed vulnerability is believed to have been involved in attacks against many organizations around the world, including high-profile companies such as Toyota

Advertisement. Scroll to continue reading.

Update 12/20/2023: The number of impacted individuals has been made public and it’s nearly 36 million.

Related: Citrix, Gov Agencies Issue Fresh Warnings on CitrixBleed Vulnerability

Related: Ransomware Group Leaks Files Allegedly Stolen From Boeing

Related: Exploitation of Critical ownCloud Vulnerability Begins

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

CISO Strategy

Okta is blaming the recent hack of its support system on an employee who logged into a personal Google account on a company-managed laptop.

Data Breaches

Sony shares information on the impact of two recent unrelated hacker attacks carried out by known ransomware groups. 

Data Breaches

A group of hackers has leaked Atlassian employee records and floorplans, information that was obtained from third-party workplace platform Envoy.

Data Breaches

Delta Dental of California says over 6.9 million individuals were impacted by a data breach caused by the MOVEit hack.

Data Breaches

KFC and Taco Bell parent company Yum Brands says personal information was compromised in a January 2023 ransomware attack.