Yahoo’s initial estimate of victims of it’s 2013 hack was significantly smaller than reality.
When Yahoo divulged it’s 2013 hack, they believed that around one million users had their information breached. Users were misinformed. It has now come to light that all three billion users may have had names, email addresses, phone numbers, birth days, and passwords breached.
The extent of the hack was discovered during a forensic investigation by a third party during the acquisition of Yahoo by Verizon.
Yahoo users were forced to change their passwords after discovery of the breach. Users should also ensure that if they share passwords between logins with other services that those passwords get changed as well.