“Your privacy matters to us. We know you rely on us to stay connected to the people and things you care about most. And your privacy is essential when you use our products and services. That’s why we’re always working to keep your personal information secure and put you in control of it.”

💡 This public promise from Comcast’s website shows the company understood its duty to protect customer data, making its failure to do so even more egregious.

“We believe strong cybersecurity is essential to privacy. We help protect you with multiple layers of security that automatically detect and block hundreds of thousands of cyber events every second and a team of security experts who work to protect you 24 hours a day, 365 days a year.”

💡 Comcast explicitly promised round-the-clock protection from cyber threats, a promise the massive data breach proves was hollow marketing language rather than operational reality.

“We follow industry-standard practices to secure the information we collect to prevent the unauthorized access, use, or disclosure of any personal information we collect and maintain. These security practices include technical, administrative, and physical safeguards, which may vary, depending on the type and sensitivity of the information.”

💡 Comcast’s own privacy policy establishes that the company committed to following industry standards to protect customer information, standards it admittedly failed to meet.

“Defendants failed to adequately protect Plaintiff’s and Class Members’ PII and failed to even encrypt or redact this highly sensitive information. This unencrypted, unredacted PII was compromised due to Defendants’ negligent and/or careless acts and omissions and their utter failure to protect their customers’ sensitive data.”

💡 This shows Comcast did not even take the basic step of encrypting Social Security numbers and other highly sensitive data before sharing it with a third-party vendor.

“On March 13, 2024, FBCS notified Comcast that it had experienced a data breach incident, but that Comcast consumer data was not impacted. However, on July 17, 2024, FBCS notified Comcast of its new finding that Comcast data was impacted.”

💡 Comcast learned of the breach in March but did not notify customers until August, leaving victims vulnerable to identity theft for months while unaware their information had been stolen.

“FBCS received your information because they previously provided Comcast with collections-related services for delinquent payments until 2020, when Comcast ceased working with FBCS. The compromised information about you dates from around 2021, as FBCS is subject to data retention requirements beyond Comcast’s working relationship with FBCS.”

💡 Comcast allowed a debt collector to retain sensitive customer data for years after their business relationship ended, unnecessarily exposing former customers to risk.

“In a filing with the Office of the Maine Attorney General, FBCS confirms that the PII of 4,253,394 individuals was exposed by the Data Breach.”

💡 This shows the massive scale of the breach affecting more than 4.2 million people, demonstrating how one vendor’s security failure can harm millions across multiple corporations.

“On October 3, 2024, Comcast filed a notice with the Maine Attorney General confirming that 237,703 individuals impacted by the FBCS data breach were related to the Comcast portion of the breach.”

💡 This official filing confirms that nearly a quarter million Comcast customers had their sensitive personal information exposed due to the company’s failures.

“According to the Comcast Notice, the PII involved in the Data Breach may include Plaintiff’s and Class Members’ name, address, Social Security number, date of birth, Comcast account number, and ID numbers used internally at FBCS.”

💡 The breach exposed the exact combination of information criminals need to steal identities, open fraudulent accounts, and cause lasting financial harm to victims.

“PII can be sold at a price ranging from $40 to $200. Criminals can also purchase access to entire company data breaches from $900 to $4,500.”

💡 This demonstrates the significant black market value of the stolen information, proving that cybercriminals had strong financial incentives to exploit the breach.

“The retail cost of credit monitoring and identity theft monitoring can cost around $200 a year per Class Member. This is a reasonable and necessary cost to monitor and protect Class Members from the risk of identity theft that arose from the Data Breach. This is a future cost, for a minimum of five years, that Plaintiff and Class Members would not need to bear but for Defendants’ failure to safeguard their PII.”

💡 Victims now face $1,000 in credit monitoring costs over five years, expenses they would never have incurred if Comcast had properly protected their information.

“The present and continuing risk to victims of the Data Breach will remain for their respective lifetimes. Once PII is stolen—particularly Social Security numbers—fraudulent use of that information and damage to victims may continue for years.”

💡 Unlike stolen credit cards that can be cancelled, Social Security numbers cannot be changed, meaning victims face permanent vulnerability to identity theft for the rest of their lives.

“Law enforcement officials told us that in some cases, stolen data may be held for up to a year or more before being used to commit identity theft. Further, once stolen data have been sold or posted on the Web, fraudulent use of that information may continue for years. As a result, studies that attempt to measure the harm resulting from data breaches cannot necessarily rule out all future harm.”

💡 This government finding proves that the harm from this breach may not surface for years, meaning victims cannot yet know the full extent of damage they will suffer.

“Compared to credit card information, personally identifiable information is worth more than 10x on the black market. The information compromised in this Data Breach—names and Social Security numbers—is impossible to close and difficult, if not impossible, to change.”

💡 This explains why the stolen information is far more dangerous than a typical payment card breach, as victims cannot simply cancel their Social Security numbers the way they would a credit card.

“The FTC recommends that companies not maintain PII longer than is needed for authorization of a transaction, limit access to sensitive data, require complex passwords to be used on networks, use industry-tested methods for security, monitor the network for suspicious activity, and verify that third-party service providers have implemented reasonable security measures.”

💡 Federal regulators have clearly spelled out what companies must do to protect data, making Comcast’s failure to follow these guidelines particularly inexcusable and potentially illegal.