Yahoo said on Wednesday that more than a billion users may have had data stolen in a hack dating back to 2013, AFP reports.
The company said it made the discovery as it was investigating what was already the largest data breach of a single company.
"Yahoo believes an unauthorized third party, in August 2013, stole data associated with more than one billion user accounts," it said in a statement quoted by AFP.
The company stressed this case "is likely distinct from the incident the company disclosed on September 22, 2016."
The breach disclosed in late September, which affected 500 million users, had already threatened to derail a deal the company made to sell its core operating assets to Verizon.
In November, Yahoo disclosed that as part of its investigation into the prior breach, it had received data files from law enforcement "that a third party claimed was Yahoo user data."
Using outside forensic experts, Yahoo confirmed that this was indeed user data but added that it "has not been able to identify the intrusion associated with this theft."
The stolen user account information in the newly disclosed breach may have included names, email addresses, telephone numbers, dates of birth, "hashed" passwords and, in some cases, encrypted or unencrypted security questions and answers, Yahoo said, according to AFP.
The hackers did not obtain passwords in clear text, payment card data, or bank account information, the company added.