Hackers stole information from about 500 million users from Yahoo, the company has confirmed.
It did not include any credit card data, the site said, adding it believed the attack was state-sponsored.
In July, Yahoo was sold to US telecoms giant Verizon for $4.8bn (£3.7bn).
It is not yet known if the breach will have an impact on that sale or its valuation.
News of a possible major attack on Yahoo emerged in August when a hacker known as "Peace" was apparently attempting to sell information on 200 million Yahoo accounts.
Yahoo on Thursday confirmed the breach was far bigger than first thought.
It recommended all users should change their passwords if they had not done so since 2014.