The web giant, now owned by Verizon, disclosed the theft of 500 million records in September 2016, only to reveal in December a separate theft of one billion records.
"Based on an analysis of the information with the assistance of outside forensic experts, Yahoo has determined that all accounts that existed at the time of the August 2013 theft were likely affected," Yahoo disclosed Tuesday after the market closed.
"It is important to note that, in connection with Yahoo's December 2016 announcement of the August 2013 theft, Yahoo took action to protect all accounts. The company required all users who had not changed their passwords since the time of the theft to do so," the statement read.
The company still hasn't said who is behind what it claims is a state-sponsored attack, nor which state may have sponsored the hackers...
Read more: Yahoo says all 3 billion accounts hit by 2013 hack | ZDNet