To put things in perspective, 3 billion -- every account ever registered on Yahoo -- is greater than the number of every user on Facebook, Instagram and Twitter combined.
"Following an investigation with the assistance of outside forensic experts, [we believe] that all Yahoo user accounts were affected by the August 2013 theft," Suzanne Philion, a spokeswoman for the Verizon unit Oath, said in a statement on Tuesday.
It's a landmark development for an already historic breach, and it comes as people are still reeling from yet another supersized hack, an incident at credit-monitoring company Equifax. That one, revealed less than a month ago, affected 145 million Americans, or roughly half the US population, and last week cost Equifax's CEO his job.
Watch this: Former Equifax CEO apologizes to Congress, blames hack on human error
Yahoo said it didn't suffer a new breach, but rather learned of 2 billion additional users having been affected in its 2013 incident. It's sent a notification to all its users, telling them that it had taken action in 2016 to protect all accounts, requiring password changes and blocking access from accounts with unencrypted security questions.
The information stolen in the massive breach did not include passwords in clear text, payment card data or bank account information. Yahoo is still working with law enforcement to determine who was behind the attack.