Yahoo says “state-sponsored” hackers stole data on about 500 million users in what could be the largest publicly disclosed cyber-breach in history.
The breach included swathes of personal information, including names and emails, as well as “unencrypted security questions and answers”.
The hack took place in 2014 but has only now been made public.
In the UK it is believed data on about eight million user accounts was taken in the hack.
Stolen data includes names, email addresses, telephone numbers, dates of birth and encrypted passwords, but not credit card data, Yahoo said.
It said the information was “stolen by what we believe is a state-sponsored actor” but did not say which country it held responsible.
The FBI has confirmed it is investigating the claims.
Password change urged
News of a possible major attack on the technology firm emerged in August when a hacker known as “Peace” was apparently attempting to sell information on 200 million Yahoo accounts.
On Thursday, Yahoo confirmed the breach was far bigger than first thought.