Just three days after Xfinity disclosed that 36 million of its users’ personal information was exposed in a data breach, Fort Lauderdale-based Citrix Systems Inc. is facing a class-action lawsuit accusing the firm of failing to prevent the breach.
The extent of the breach was disclosed on Monday in a notice to the Maine Attorney General by Comcast Cable Communications, which does business as Xfinity.
That day, Comcast released a notice to customers disclosing that “unauthorized access to its internal systems” had occurred between Oct. 16 and Oct. 19. Following a review, Comcast concluded on Dec. 6 that the breach exposed customer information such as usernames and passwords that the company had disguised for security purposes.
Hackers also stole some users’ names, contact information, last four digits of Social Security numbers, dates of birth and/or secret questions and answers, Comcast said.
Customers logging onto their Xfinity accounts have been required to change their passwords to protect their accounts. They also are urged to set up two-factor, or multi-factor, authentication and to change passwords for other accounts that share the same username and password or security question.
By Wednesday, Citrix — which services Xfinity’s website — was named as defendant in a proposed class-action lawsuit about the breach.
A Citrix spokesman, reached by email, said the company is aware of the lawsuit but said the company does not comment on pending litigation. Comcast, which was not named as a defendant in the lawsuit, did not respond to a request for information about the breach.
The suit accuses Citrix of failing to protect “highly sensitive information” in their custody that it “knew and understood” is “valuable and highly sought after by criminal parties who seek to illegally monetize” it by posting it for sale on the dark web.
The suit states that Citrix on Oct. 10 announced the vulnerability of a software product used by Xfinity and thousands of other companies known as “Citrix Bleed.”
Citrix said it released a patch to fix the vulnerability at that time and issued additional mitigation guidance on Oct. 23, the lawsuit claims.
While Comcast said it “promptly patched and mitigated its systems,” it said it later discovered that prior to the repair operation, between Oct. 16 and Oct. 19, “there was unauthorized access to some of (its) internal systems that (it) concluded was a result of this vulnerability,” according to the lawsuit.
In a notification to the Office of the Maine Attorney General on Monday, Comcast revealed that the personal identifiable information of 35,879,455 individuals was believed to have been exposed in the breach.