BBC: Yahoo says hackers stole information from about 500 million users in 2014 in what appears to be the largest publicly disclosed cyber-breach in history.
The breach included swathes of personal information including names and emails as well as “unencrypted security questions and answers”.
It did not include any credit card data, the site said, adding it believed the attack was state-sponsored.
In July, Yahoo was sold to US telecoms giant Verizon for $4.8bn (£3.7bn).
Password change urged
News of a possible major attack on the technology firm emerged in August when a hacker known as “Peace” was apparently attempting to sell information on 200 million Yahoo accounts.
Yahoo on Thursday confirmed the breach was far bigger than first thought.
The data taken includes names, email addresses, telephone numbers, dates of birth and encrypted passwords.
Yahoo recommended all users should change their passwords if they had not done so since 2014.
Verizon told the BBC it had learned of the hack “within the last two days” and said it had “limited information”.
The company added: “We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities.
“Until then, we are not in position to further comment.”
Yahoo said in a statement: “Online intrusions and thefts by state-sponsored actors have become increasingly common across the technology industry.”
Reuters reported three unnamed US intelligence officials as saying they believed the attack was state-sponsored because it was similar to previous hacks linked to Russian intelligence agencies.
Nikki Parker, vice-president at security company Covata, said: “Yahoo is likely to come under intense scrutiny from regulators, the media and public and rightly so. Corporations can’t shy away from data breaches and they must hold their hands up and show that they are committed to resolving the problem.”
She added: “Let’s hope the ink is dry on the contract with Verizon.”
The scale of the hack eclipses other recent, major tech breaches – such as MySpace (359 million), Linkedin (159 million) and Adobe (152 million).
Yahoo was founded in 1994 by Jerry Yang and David Filo and in its first decade was a pioneer of internet services.
It was once the most popular website in the US and the company was worth more than $100bn, but Yahoo lost ground towards the end of the first decade of the century, leading to its purchase by Verizon.
Yahoo Timeline
- 1994 Yahoo – which stands for Yet Another Hierarchically Organized Oracle – is founded
- 2000 Yahoo valued at $125bn at height of dot.com boom
- 2002 Google rejects a $3bn bid from Yahoo
- 2008 Microsoft’s $44.6bn offer for Yahoo is turned down
- 2013 Blogging site Tumblr acquired by Yahoo for $1.1bn
- 2015 Yahoo makes net loss of $4.4bn
- 2016 Verizon agrees $4.8bn deal to buy Yahoo
