Yahoo said that attackers who managed to create the company's cookies were able to gain access to about 32 million user accounts without passwords.
"External forensic experts have identified approximately 32 million user accounts that they believe were compromised using fake cookies in 2015 and 2016," Yahoo revealed in its annual report filed with the U.S. Securities and Exchange Commission (SEC) on Wednesday.
“We believe that some of this activity is linked to the same state-sponsored hackers believed to be responsible for the 2014 security incident.”
Yahoo began warning some of its customers in mid-February that attackers were accessing their accounts using sophisticated cookies.
The company revealed details of the first hack in September last year, saying that about 500 million user accounts were compromised. Yahoo also said that while passwords and some other information were leaked, the hackers were unable to obtain bank account information.
A second breach was revealed in December, in which more than 1 billion accounts are believed to have been stolen in August 2013.
In a statement at the time, Yahoo said that hackers had stolen names, email addresses, phone numbers, hashed passwords, dates of birth, and in some cases, encrypted and unencrypted security questions and answers.
To date, there are about 43 lawsuits filed against Yahoo in the United States over the security incidents. Last month, Yahoo and Verizon agreed to reduce the price of their upcoming acquisition deal by $350 million in the wake of the two attacks and are expected to share some of the legal and regulatory burdens when the deal between the two companies closes.
The deal, currently valued at approximately $4.48 billion, is expected to close in the second quarter of 2017.
