Comcast has agreed to pay $33 million to settle allegations that the cable company published the names, numbers, and addresses of about 75,000 Californians who had paid for unlisted phone services, including survivors of domestic abuse.
The company exposed the information over a two-year period between 2010 and 2012 through an update error to its security system, according to Comcast spokeswoman Jenny Gendron. The information was sold through a data licensing company and published online and in phone books, according to court records.
Comcast will pay a total of $7.5 million to customers affected by the breach.
Each affected customer will receive $100, but an additional restitution amount will be given to about 200 domestic violence victims, law enforcement officers, and judges who were put at special safety risk as a result of the breach.
The company will also pay the California Department of Justice and California Public Utilities Commission an added $25 million in penalties and investigative costs.
"This settlement provides meaningful relief to victims, brings greater transparency to Comcast's privacy practices, and sends a message that violations of consumers' privacy will result in significant penalties," said California Attorney General Kamala Harris in a statement on Thursday.
Comcast, based in Philadelphia, must also improve how it handles customer grievances and strengthen its restrictions on how its data vendors use customer information. It failed to address about 350 customer complaints it received between 2010 and 2012 related to the data leak, according to the complaint.
"It's important that Comcast receive a strong message and what they tend to hear is money," said Mindy Spatt, a spokesperson for The Utilities Reform Network, a San Francisco-based consumer advocacy organization.
In a statement to BuzzFeed News, a Comcast spokesperson said they were pleased by the settlement "that brings this matter to a close."
"We value and work hard to protect our customers' privacy," the spokesperson said . "We apologize to anyone who was impacted by this."
The restitution payment will appear on the upcoming telephone bills of customers affected by the breach.