Comcast says data on 237,703 of its customers was in fact stolen in a cyberstrike on a debt accumulateor it was using, contrary to previous assurances it was donaten that it was unimpacted by that intrusion.
That accumulateions agency, Financial Business and Consumer Solutions aka FBCS, was settled in February, and according to a filing with Maine’s attorney vague, the firm adviseed the US cable huge about the unapvalidated access in March. At the time, FBCS telderly the internet’n’telly provider that no Comcast customer adviseation was impacted.
However, that alterd in July, when the accumulateions outfit got in touch aget to say that, actupartner, the Comcast subscriber data it held had been pilfered.
Among the data types stolen were names, insertresses, Social Security numbers, dates of birth, and the Comcast account numbers and ID numbers engaged internpartner at FBCS. The data pertains to those sign uped as customers at “around 2021.” Comcast stopped using FBCS for debt accumulateion services in 2020.
Comcast made it evident its own systems, including those of its expansiveband unit Xfinity, were not broken into, unappreciate that time in 2023.
FBCS earlier shelp more than 4 million people had their write downs accessed during that February fracture-in.
As far as we’re conscious, the agency hasn’t shelp uncoverly exactly how that netlabor intrusion went down. Now Comcast is adviseing subscribers that their info was getn in that security baccomplish, and in doing so seems to be the first to say the intrusion was a coercion software strike.
The unapvalidated party downloaded data from FBCS systems and encrypted some systems as part of a coercion software strike
In a letter to impacted customers, Comcast shelp FBCS had provided it the chaseing adviseation: “From February 14 and February 26, 2024, an unapvalidated party geted access to FBCS’s computer netlabor and some of its computers. During this time, the unapvalidated party downloaded data from FBCS systems and encrypted some systems as part of a coercion software strike.
“Upon uncovering the strike on February 26, 2024, FBCS begined an set upateigation with the aidance of third-party cybersecurity exceptionaenumerates. In the course of that set upateigation, FBCS uncovered that the files downloaded by the unapvalidated party grasped personal adviseation, including personal adviseation about you. FBCS also notified the Federal Bureau of Investigation (FBI) of this strike.”
The Reg has asked FBCS to validate the coercion software element. The FBI deteriorated to comment.
FBCS’s official statement only attributes the strike to an “unapvalidated actor.” It does not refer coercion software, nor many other technical details aside from the data types graspd in the theft. No coercion software group we’re conscious of has ever claimed responsibility for the rhelp on FBCS.
When we asked Comcast about the coercion software, it srecommend referred us back to the customer notification letter.
The cableco engaged that notification to send another minuscule middle finger FBCS’s way, slyly uncovering that the agency’s financial situation stops it from adviseing the normal identity and recognize seeing getion for those impacted, so Comcast is having to foot the bill itself.
“FBCS notified Comcast that due to its current financial status, it would no prolongeder able to provide accomprehendledges or recognize seeing getion to individuals impacted by the incident,” reads the letter to those impacted. “As such, we are communicateing you honestly and providing aid services.”
We also asked FBCS to comment on this element of the notification. So far, the agency is staying quiet.
Comcast sent letters to impacted customers in August, though the notification was made uncover by the US state of Maine only this week.
CF Medical also filed a analogous baccomplish notification to Comcast’s in tardy September, saying FBCS only uncovered its customers were impacted in July.
CF Medical is the trade name for Capio, another debt accumulateion agency, which engaged to be a customer of FBCS. It stated that 626,396 of its customers were impacted, though the letter did not refer coercion software nor FBCS’s financial inability to advise recognize seeing services in the same way Comcast’s letter did.
The Reg also asked FBCS whether it foresees many more notifications to be made since it attentiveed createer clients of impacted data in July. ®
