Yahoo has announced that hackers stole data from more than one billion of its user accounts in August 2013, in what is thought to be the largest data breach at an email provider.
The company disclosed that breach in September. Yahoo said it hasn’t identified the intrusion associated with this theft.
Yahoo says the information stolen may include names, email addresses, phone numbers, birthdates and security questions and answers.
The company says it believes bank-account information and payment-card data were not affected.
Bosses say it was a different attack to one in 2014 that was revealed in September and involved 500 million accounts.
The technology giant made the latest discovery as it was investigating the 2014 hack, which it had said was “state sponsored”, although some analysts questioned that theory.
Yahoo believes an unauthorised third party was behind the newly revealed hack and said it was working closely with authorities.
It said in a statement: “Yahoo believes an unauthorised third party, in August 2013, stole data associated with more than one billion user accounts.”
Yahoo said this case “is likely distinct from the incident the company disclosed on September 22, 2016”.
Verizon, which is in the process of buying Yahoo for $4.8bn (£3.8bn), said of the 2013 hack: “We will review the impact of this new development before reaching any final conclusions.”
The breach disclosed in September had already threatened to derail the deal or result in a reduction in the sale price.
Yahoo used to be one of the internet’s biggest names but has failed to keep up with the likes of Google and Facebook.