The company, which was taken over by Verizon earlier this year, said an investigation had shown the breach went much further than originally thoughtThe stolen data did not include passwords in clear text, payment card or bank account data, it added.
Previously the internet giant had said "more than one billion" of its accounts had been hit.
