Researcher Karan Saini finds a bug in Comcast's website that leaks Xfinity users' info, including home address where the router is located and Wi-Fi credentials
Exclusive: A bug in Comcast's website leaks sensitive customer information. — A bug in Comcast's website used …
Context & Ripple Effects
Karan Saini's find is the latest entry in a long Comcast disclosure file: back in 2015 the company had to reset nearly 200,000 passwords after a customer list went up for sale, and a few months later Motherboard documented a nearly identical class of flaw at MetroPCS, where a carrier website left subscriber personal data open to anyone who knew where to look.
The pattern matters because the exposed fields here — physical home address tied to the router, plus Wi-Fi credentials — sit at the intersection of physical security and network access, and Comcast's subsequent record ([[a:932255|Xfinity flaws exposing partial addresses and Social Security numbers of over 26.5M customers]] months later, published unlisted phone numbers in 2020, and the 2023 Citrix server breach affecting roughly 36 million people) suggests website-level data handling was not an isolated slip.
First-order effects
- Xfinity customers whose accounts were queried through the buggy endpoint have their home address and Wi-Fi credentials exposed to anyone able to reach it — a direct physical-safety risk, since the address points to where the router actually sits.
- Comcast has to patch the endpoint and answer researcher disclosure on its own terms, while its security team now owns a credential-leak problem that touches customers' home networks, not just their web accounts.
Second-order effects
- Leaked Wi-Fi credentials convert a web bug into a home-network intrusion vector, pushing Comcast toward forced credential resets and support costs of the kind it already absorbed in the 2015 password-reset episode.
- Rival ISPs face the same researcher playbook — MetroPCS's near-identical site bug shows carrier self-service portals are a repeatable target — so every large provider's account lookup flows become audit surface whether or not they have been hit yet.
Third-order effects
- If the recurrence holds — 2015 credential sales, two 2018 web flaws, 2020 directory publication, 2023's tens-of-millions-record breach — Comcast's data-governance practices become a standing case study for regulators weighing how much breach liability ISPs should carry for customer data they hold by default.
- The broader structural shift is that ISP-held telemetry (addresses, device locations, network credentials) gets treated less like billing records and more like sensitive personal data, raising the compliance floor for every carrier portal built before that assumption held.
The trend: ISP customer-data handling is moving from ad-hoc website fixes to a recurring, regulator-visible accountability problem, as researchers keep demonstrating that carrier portals expose more than they should.