Comcast Data Breach (2015): What Was Exposed & What To Do

In November 2015, Comcast reported a data breach that affected 617,000 customer accounts. The exposed records included email addresses and passwords stored in plain text for roughly 590,000 accounts, along with physical addresses tied to an additional 27,000 accounts; the full set was offered for sale on underground forums. The incident is one of many credential exposures that occurred as online service providers became routine targets for attackers seeking reusable login data.

Inside the incident

The breach was made public on November 8, 2015. Available reporting states that the compromised records contained email addresses and passwords in clear text, with a subset also including home addresses. No further technical details on the intrusion method, duration, or exact files accessed have been disclosed in public accounts of the event. The data set was described as having been placed for sale on underground forums, though the scale of any subsequent use remains unconfirmed.

How a breach like this happens

Incidents involving the theft of email addresses and passwords commonly begin with attackers gaining access to a provider’s customer database or authentication system. This access can occur through stolen administrative credentials, exploitation of unpatched software, or misconfigured access controls that allow unauthorized queries. Once obtained, the records are often packaged and distributed on forums where they are tested against other services to identify accounts that reuse the same credentials.

About Comcast

Comcast is a large United States provider of internet, cable television, and related communications services. Organizations in this sector maintain extensive customer databases that include contact details, billing addresses, and account credentials required for service activation and management. A breach at such a provider is consequential because the records can be used to target individuals across multiple online platforms where the same email and password combinations are reused.

What was likely exposed

Public reporting on the incident identifies three categories of customer information as having been present in the data offered for sale. The precise contents of every record remain unconfirmed beyond these categories.

• Email addresses
• Passwords stored in plain text
• Physical addresses (limited to a subset of accounts)

What's at stake

For individuals whose records were involved, the primary concern is the potential for unauthorized access to other online accounts that share the same email and password. Organizations holding similar data face the operational costs of notifying customers, resetting credentials, and strengthening authentication controls. In both cases the impact depends on whether the exposed passwords were unique to Comcast or reused elsewhere.

If your data was in this breach

Change the password on any Comcast account and on any other service where the same password was used. Enable multi-factor authentication where available and review recent account activity for signs of unauthorized access. Readers can run a free exposure scan of their email address to check whether their information appears in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.