"Xfinity Customer Data Compromised in Attack Exploiting CitrixBleed Vulnerability"
Comcast’s Xfinity recently announced that customer information had been compromised in a cyberattack that involved exploitation of the vulnerability known as CitrixBleed. CitrixBleed, officially tracked as CVE-2023-4966, is a critical vulnerability affecting Citrix’s Netscaler ADC and Gateway appliances. Malicious actors can exploit the flaw to hijack existing sessions, which can give them access to the targeted organization’s systems. Patches were announced by Citrix on October 10, but the vulnerability had been exploited as a zero-day since August. In Xfinity’s case, it “promptly patched and mitigated” the vulnerability within its systems. However, it discovered on October 25 during a routine cybersecurity exercise that CitrixBleed had been exploited against its systems, with hackers having access between October 16 and 19. An investigation revealed on November 16 that information had likely been stolen by the attackers. While the analysis is ongoing, Xfinity determined on December 6 that customer information, such as usernames and hashed passwords, have been compromised. Xfinity noted that for some customers, information such as name, contact details, date of birth, last four digits of social security number, and security questions and answers may have also been stolen.