Comcast data breach 2015: what happened and what to do

What happened

In November 2015, a list of Comcast customer login details was offered for sale. Have I Been Pwned (HIBP) dates the breach to 8 November 2015, added it on 8 February 2016 and lists 616,882 affected accounts.

HIBP's entry describes about 590,000 email addresses and plain-text passwords. A further group of around 27,000 accounts appeared with physical addresses attached, which accounts for the difference between that figure and HIBP's total. The passwords weren't hashed, so anyone who held the list could read them.

Comcast's position at the time, as reported, was that its own systems hadn't been broken into. The source of the list was never made clear in the coverage I found. HIBP's entry is the reliable reference for the count and the data fields. Check Comcast's own pages for anything it has published since.

Don't confuse it with Xfinity's 2023 incident

Comcast's Xfinity service had a separate and much larger incident connected to a Citrix software flaw that was disclosed in 2023. It involved usernames and hashed passwords. The two aren't related, and the numbers on this page belong only to the 2015 list.

What was exposed

HIBP lists three types of data: email addresses, passwords and physical addresses. Phone numbers and payment details aren't in its list.

The email and password pair is the dangerous part. A Comcast login also tends to be an email login, since comcast.net addresses were common, so a reused password can open a mailbox. The mailbox then opens everything that can send it a reset link.

The physical addresses add a second problem. They tie a login to a home. For the roughly 27,000 accounts that carry one, a scam that quotes a street address looks more credible.

What criminals can do with it

Attackers try email and password pairs on other sites in bulk. If your Comcast password matched your bank's, the bank is where the damage happens. Old passwords also reveal habits. People tend to build new passwords from old ones, so a leaked 2015 password helps someone guess a 2025 one.

What to do about an old breach like this

This breach is more than ten years old and the passwords are probably stale. The risk now is the habit behind them. If you've changed the password since 2015 and never reused it, there's little left to fix. If not, work through the steps below.

There's a wider lesson in how old this is. Plain-text storage was common in 2015 and is now treated as a serious failure. You can't see how a company stores your password, so the only protection you control is making each password unique. Then a leak at one company stays at that company.