More than one billion Yahoo accounts may have been affected in a hacking attack dating back to 2013, the internet giant reveals.
Yahoo said it appears separate from a breach disclosed in September, when it revealed some 500 million accounts were accessed in 2014.
The company said names, phone numbers, passwords and email addresses were stolen, but not bank and payment data.
Yahoo, which is being taken over by Verizon, said it is working closely with the police and authorities.
When Yahoo disclosed in September the 2014 data breach, the internet giant said information had been “stolen by what we believe is a state-sponsored actor”. Yahoo did not say which country it held responsible.
The 2014 breach included swathes of personal information, including names and emails, as well as “unencrypted security questions and answers”.
Yahoo has come under pressure to disclose why it took so long for the breach to be made public.
The new breach raises fresh questions about Verizon’s $4.8 billion proposed acquisition of Yahoo, and whether the US mobile carrier will try to modify or abandon its bid.
If the hacks cause a user backlash against Yahoo, the company’s services would not be as valuable to Verizon.
In a statement, Verizon said that it would evaluate the situation as Yahoo investigates and would review the “new development before reaching any final conclusions”.
On December 14, Yahoo said that users should change their passwords and security questions.
Verizon has agreed to buy AOL in a deal worth $4.4 billion.
Buying AOL will broaden the amount of advertising Verizon can sell and will increase video production.
AOL owns websites such as the Huffington Post, Techcrunch, Engadget, Makers and AOL.com.
Verizon is trying to become more of a one-stop shop for internet services and entertainment.
AOL, famous for posting compact discs for its services through thousands of letterboxes in the 1990s, still has two million customers for its slower dial-up internet service.
It also became memorable for its messaging service, which would greet users with an audio clip that would cheerfully announce “you’ve got mail!”.
In 2001, during the dotcom stock market bubble, AOL merged with Time Warner in a deal valued at more than $160 billion when it was announced. The deal was unwound in 2009 when AOL was split off into a separate company.
In 2014, AOL had only 0.74% of the $145 billion global digital advertising market, according to eMarketer. Market leader Google had 31.4% market share last year, followed by Facebook with 7.9%.
As well as automated advertising, Verizon said the deal would give impetus to its 4G wireless video and internet video ambitions, and feed into its plans for capitalizing on the so-called “internet of things”.
AOL CEO Tim Armstrong will continue to lead the company if the deal goes through – the transaction is subject to regulatory approval.
“We are excited to work with the team at Verizon to create the next generation of media through mobile and video,” Tim Armstrong said.
Verizon is offering $50 a share for AOL, compared with AOL’s closing price of $42.59 on May 11.