The US internet giant Yahoo says personal data from more than one billion user accounts run by the company was stolen in a hack dating back to 2013, in what appears to be the largest publicly disclosed cyber-breach in history.
“Yahoo believes an unauthorized third party, in August 2013, stole data associated with more than one billion user accounts,” the internet company said in a statement on Wednesday, adding that it “has not been able to identify the intrusion associated with the theft.”
Names, phone numbers, passwords, and email addresses were stolen in the hacking, but not bank-account information and payment-card data, according to the statement.
Yahoo said the current disclosure differed from an earlier one made back in September revealing that 500 million users had been affected in a 2014 hack.
The Wednesday statement also noted that, “Yahoo has taken steps to secure user accounts and is working closely with law enforcement.”
Yahoo urged all its account users to change their passwords, and it invalidated all unencrypted security questions and answers.
The new revelation comes only months after Yahoo sealed a deal to sell its core internet business to telecom giant Verizon for 4.8 billion dollars, ending a two-decade run as an independent company.
Verizon had earlier described the September breach as “material,” meaning it could allow the telecom giant to scrap the deal or lower its offer.
“We will review the impact of this new development before reaching any final conclusions,” Verizon said after the latest disclosure.
Yahoo reported earlier this year that some 200 million accounts may have been accessed and that hacked data was being offered for sale online.