However, Yahoo's investigation suggests that no payment card data or banking details were stolen in the breach, the company added.
Yahoo said it was working "closely with law enforcement" over the breach.
In the immediate aftermath of the breach, Yahoo! resolutely failed to do a password reset for their customers, which is peculiar behaviour to say the least.
Such a revelation would confirm earlier reports that the same hacker who stole data from LinkedIn was now selling information from 200 million Yahoo accounts on a dark Web marketplace.
The data allegedly included usernames, encrypted passwords, birth dates and in some cases alternative email addresses.
'Sully' soars over 'Blair Witch,' 'Bridget' at box office
In milestones, Illumination Entertainment and Universal's "The Secret Life of Pets" crossed $800 million globally. Blair Witch will still likely finish the weekend at #2, but it's not clear which of the other two will claim #3.
Confirmation of the hack comes almost two months after Verizon announced plans to buy Yahoo for some $4.8 billion in cash.
The company has since determined that the breach is real and that it's even worse than initially believed, news website Recode reported Thursday, citing unnamed sources familiar with the investigation. Those close to the matter claim the hack is just as bad, if not worse, than what was revealed last month. The verbiage used here is significant as data breaches happen all the time but "massive data breach sounds" like it could be pretty severe and widespread.
It was not clear how such a disclosure might affect Yahoo's plan to sell its email service and other core internet properties to Verizon Communications Inc for US$4.8 billion. However they're recommending any user who hasn't updated their password since 2014 to do so. Both Yahoo and Verizon will continue to meet to review the former's business so that the transition can run smoothly once regulatory agencies and shareholders ok the deal.
That's when high-tech thieves hacked into Yahoo's data centers, the company said.