Yahoo's infamous 2013 hack was three times bigger than initially thought, affecting all three billion of its users, according to an external forensic analysis.
The analysis revised the number of users affected up from the one billion revealed in December last year to three billion.
Yahoo was bought by Verizon for $4.5 billion earlier this year, and is now part of the telco's Oath subsidiary.
Verizon said that while the sharply increased number of affected users isn't "a new security issue", Yahoo is emailing to advise the additionally hacked customers to alert them.
Affected users are required to change their passwords, and their security questions to reset login credentials have been invalidated and have to be renewed.
Yahoo believes the information stolen amounted to phone numbers, dates of birth, hashed passwords, and encrypted and clear-text security questions, and the answers to them.
"The investigation indicates that the user account information that was stolen did not include passwords in clear text, payment card data, or bank account information," Verizon said.
