Yahoo on Tuesday said that all 3 billion of its accounts were hacked in a 2013 data theft, including email, Tumblr, Fantasy and Flickr – tripling its earlier estimate of the size of the largest breach in history, which already had spawned a nationwide lawsuit.
Names, email addresses and passwords, but not financial information, were breached, Yahoo said last year.
The new disclosure comes four months after Verizon acquired Yahoo’s core internet assets for $4.48 billion. Yahoo is part of Verizon’s digital media company, which is called Oath. The closing of the Verizon deal, which was first announced in July, had been delayed as the companies assessed the fallout from two data breaches that Yahoo disclosed last year.
Verizon revised the number of breached accounts to three billion after receiving new information. In a prepared statement Verizon confirms that the company recently obtained new intelligence and now believes, following an investigation with the assistance of outside forensic experts, that all Yahoo user accounts were affected by the August 2013 theft.
Yahoo will send emails to the additional affected accounts. Following the hacking revelations last year, Yahoo required password changes and invalidated unencrypted security questions to protect user information.
This new revelation follows months of scrutiny by Yahoo, Verizon, cybersecurity firms and law enforcement that failed to identify the full scope of the 2013 hack.