Class-action settlements tied to data exposure and privacy claims

Comcast agreed to pay $117.5M to settle a class action tied to a large-scale breach disclosed in late 2023 that potentially affected 31M+ people. Comcast attributed the intrusion to CitrixBleed (Citrix NetScaler ADC/Gateway), a vulnerability that can enable session hijacking and credential theft; researchers warned stolen session tokens could remain valid even after patching, extending attacker access. The proposed settlement (preliminarily approved) provides reimbursement for documented losses (up to $10,000 per person) and compensation for time spent responding, while Comcast denies wrongdoing.

Separately, Google agreed to pay $135M to settle Android users’ claims that devices transmitted data to Google servers over cellular networks in the background without meaningful consent, with individual payouts capped (reported up to $100) and additional injunctive relief requiring clearer disclosures and express consent during setup. Two dermatology practices also reached settlements over cybersecurity incidents exposing patient data; one New Jersey practice reported unauthorized network access spanning Dec 2023–Mar 2024 and exposure of PHI/PII (including SSNs and treatment/insurance data) affecting 373,630 individuals, offering cash benefits plus credit monitoring/identity protection while denying liability.