On 14 December 2016 Yahoo revealed that a jaw-dropping billion accounts had been affected by a data breach in August 2013. The disclosure arrived hot on the heels of a 22 September admission that 500 million Yahoo accounts were compromised in a different attack in late 2014. The announcement doesnt say how many accounts that amounts to but both Reuters and the Associated Press put the figure at 3 billion. The types of information lost in the breach are unchanged:stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and encrypted or unencrypted security questions and answers.”]
Source: https://nakedsecurity.sophos.com/2017/10/04/3-billion-yahoo-accounts-affected-by-2013-breach/