Yahoo now believes that a 2013 security breach compromised every one of its 3 billion user accounts.
The internet company, now part of Verizon Communications Inc.’s (VZ) , said in 2016 that the data theft had likely affected over 1 billion accounts. Yahoo has since revised its estimates, warning in a statement that all 3 billion of its users appear to have fallen victim to one of the worst cyber hacks in history. (See also: Yahoo and AOL Will Form 'Oath'.)
This assessment was made after new intelligence, obtained during Yahoo’s integration into Verizon, was brought to the company’s attention. Outside forensic experts also assisted in the discovery.
Yahoo, which added that stolen information did not include passwords in clear text, payment card data, or bank account information, confirmed that it will now alert accounts that weren’t previously notified about the attack.
"It is important to note that, in connection with Yahoo's December 2016 announcement of the August 2013 theft, Yahoo took action to protect all accounts. The company required all users who had not changed their passwords since the time of the theft to do so. Yahoo also invalidated unencrypted security questions and answers so they cannot be used to access an account," Yahoo said Tuesday.
The two 2013 attacks, the largest known security breaches of one company’s computer network, have proved to be costly for Yahoo and its shareholders. Verizon, which acquired Yahoo for $4.48 billion in June, lowered its initial offer by $350 million, due to the financial liabilities associated with the cyber hacks. (See also: Report: Verizon Wants $1B Off Yahoo Deal.)
Forty-three consumer-class action lawsuits have been filed against the Yahoo since the incident, the company said in a May filing with the Securities and Exchange Commission. The incident also led Ronald Bell, Yahoo’s top lawyer, to resign and former CEO, Marrisa Mayer, to give up her 2016 bonus.
Yahoo’s disclosure that even more accounts were compromised could increase liabilities for its new parent company Verizon. Earlier this year, Verizon and holding company Altaba Inc. agreed to split legal liabilities related to the breach. Altaba will have to handle costs related to shareholder lawsuits. (See also: Here's Why Verizon Buying Netflix Would Make Sense.)
In a statement, the telecommunications giant said it is working closely with law enforcement and focusing its efforts on improving Yahoo’s security “Our investment in Yahoo is allowing that team to continue to take significant steps to enhance their security, as well as benefit from Verizon’s experience and resources,” Chandra B. McMahon, Verizon’s chief information security officer, said.