Yahoo says about 3 billion accounts were affected in its 2013 data breach, up from 1bn it announced last year.
The internet company, acquired by Verizon earlier this year and combined with AOL to make Oath, announced on Tuesday that it had obtained “new intelligence” and now believes that all Yahoo user accounts were affected by the August 2013 theft.
Yahoo is now sending email notifications to the 2bn extra accounts believed to have been affected. When Yahoo revealed the breach last December, it required password changes and invalidated unencrypted security questions and answers across all accounts, not just those it thought had been compromised at the time.
Chandra McMahon, chief information security officer of Verizon, said Verizon’s investment in Yahoo is allowing the team to take “significant steps to enhance their security, as well as benefit from Verizon’s experience and resources”.
The new information was discovered during the integration with Verizon, with the assistance of outside forensic experts.