Yahoo, now part of Oath, said that every single Yahoo account was affected by a data breach that took place in 2013.

Yahoo buried the stat in a recent update to its Account Security Update page. “Based on an analysis of the information with the assistance of outside forensic experts, Yahoo has determined that all accounts that existed at the time of the August 2013 theft were likely affected,” Yahoo’s page says.

“It is important to note that, in connection with Yahoo’s December 2016 announcement of the August 2013 theft, Yahoo took action to protect all accounts. The company required all users who had not changed their passwords since the time of the theft to do so. Yahoo also invalidated unencrypted security questions and answers so they cannot be used to access an account,” Yahoo added.

Yahoo said that the company received new intelligence after it was acquired by AOL and that forensic experts discovered the attack was larger than originally thought. Yahoo will begin alerting accounts that weren’t previously notified of the attack.

In 2013, a breach allowed attackers to steal email addresses, passwords, birth dates, telephone numbers and more. Passwords stolen by the attack were still encrypted.

Verizon finished its acquisition of Yahoo in June and is folding it, with AOL, under a new subsidiary named Oath.

Source: Tech CNBC
Yahoo just said every single account was affected by 2013 attack — 3 billion in all