Xfinity / Citrix Hacking December 2023

The "Hack" on Citrix managed cloud instances happened back in October, where millions of users were impacted by a data theft.  Name, social security number (if you provided it), email addresses, phone numbers and addresses.  

Xfinity claims they patched their systems a few days after Citrix released a patch with their announcement, but Xfinity didn't figure out the impact until December, but it's far too late by then and your data was gone and likely was exposed to the wild long before Citrix figured out there was a problem and released a patch for it back in October.

YOUR personal device isn't "hacked", but your account details are.  With that, an attacker can change your password and intercept your email, and possibly for other accounts you have your Xfinity account linked with for password recovery and for two factor authentication.  They can also do this by phone since they have all of your account details to impersonate you.

For mitigation, Xfinity enforced a password change globally.  This causes issues when you have several devices checking mail and failing authentication.  Your account can be temporarily locked out.  It's also possible your account is currently hijacked and forwarding email to some other hostile actor.  Log into web mail with a browser from https://xfinity.com  (click the drop down in the upper right, and check email).   Go into settings -- the little gear icon in the upper right, and make sure you aren't forwarding mail on the left pane.  

If you can't log into webmail using your updated password that you set, then your account is compromised so you'll have to call them.  https://internetsecurity.xfinity.com/help/report-abuse   

Other users report you may also have to enable two factor authentication for your account from now on or your mail won't work.  You do that on the main login page https://xfinity.com under your account.  

If your devices can't check mail with the new password, the first thing you want to do is stop them from checking your mail and failing authentication.  They will lock your account from repeated failed attempts.  Follow the links on this post and see if any of them help:

https://forums.xfinity.com/conversations/email/apple-mail-cannot-connect-to-my-comcast-mailbox/658394bef961c6163a32ae59?commentId=65840c96f961c6163a32b286 

Remember DO NOT REUSE PASSWORDS between email accounts (comcast/owa/gmail/your bank...etc).  When one gets hacked like Xfinity, they all will.  I'd also consider Xfinity email burned.  Do not use them for anything important again.