Yahoo says it has not been able to identify the source of the intrusion, but has warned all users to change their passwords.
Internet giant Yahoo on Thursday warned that data from more than one billion user accounts may have been compromised back in August 2013.
The company disclosed a 2014 breach in September, when it revealed 500 million accounts had been hacked.
Both lapses occurred during the reign of Yahoo CEO Marissa Mayer, a once-lauded leader who found herself unable to turn around the company in the four years since her arrival.
Earlier this year, Yahoo agreed to sell its digital operations to Verizon Communications for $4.8 billion, a deal that may now be imperilled by the hacking revelations.
The company blamed the late 2014 attack on a hacker affiliated with an unidentified foreign government, but said it hasn't been able to identify the source behind the 2013 intrusion.
"We believe this incident is likely distinct from the incident we disclosed on September 22, 2016," the company said in a statement on its website.