A newly revealed Yahoo data breach, which occurred in 2013,involved personal information associated with more than one billionuser accounts, twice those affected in a different incursiondisclosed in September.

The stolen user-account information may have included names,email addresses, telephone numbers, birthdates, hashed passwords,and, in some cases, encrypted or unencrypted security questions andanswers. The investigation, according to Yahoo, so far indicatesthe stolen information did not include passwords in clear text,payment card data, or financial account information.

The Sunnyvale, Calif.-based search company, which is beingacquired by Verizon for about $4.8 billion, said an unauthorizedthird party stole the data and that it was working closely with lawenforcement.

Yahoo said it believed the latest incident waslikely distinct from the breach disclosed in September, when itrevealed personal information associated with at least 500 millionuser accounts, including names, passwords, birthdates, and emailaddresses, was stolen in 2014. In a statement in September, Yahoosaid the compromised information was taken by an unnamedstate-sponsored actor.

The Yahoo data breaches, and other incidentsinvolving the release of personally identifiable information, hasbroader implications for financial institutions and otherbusinesses.

“Yahoo should know that it is an invaluable target forcybercrime syndicates and nation-states and invest the resources toprotect its data accordingly,” Kenneth Geers, senior researchscientist at Clifton, N.J.-based cybersecurity firm ComodoEnterprise, said. “We shouldn't forget that an insider, a rivalcorporation, or even a nation-state might operate purely out ofselfish financial considerations,” Geers added.

Scott Carlson, technical fellow at Phoenix-based securitycompany BeyondTrust, also commented. “Now more than ever companiesneed to protect themselves when other companies are compromised. Weall know users reuse passwords and we can almost guarantee that theanswers to user's internal secret questions are the same as theirpersonal secret questions.”