Yahoo disclosed a data breach that ultimately affected all 3 billion of its user accounts, although that full figure was announced in 2017.
Yahoo first disclosed the underlying August 2013 breach in December 2016, initially saying that about 1 billion accounts had been compromised. In October 2017, the company revised that estimate and said every one of its approximately 3 billion accounts had been affected. Thus Yahoo is the canonical answer, but the question’s date compresses two stages of disclosure.
The stolen information included names, email addresses, telephone numbers, dates of birth, and security questions and answers. The breach was separate from another intrusion, disclosed in September 2016, that affected more than 500 million accounts.
The revelations contributed to criticism of Yahoo’s security and delayed disclosure practices and complicated Verizon’s acquisition of the company. The episode is often remembered as a “3 billion account” breach, but that exact number was not publicly confirmed until 2017.