At the time, Yahoo had urged all its users to change its passwords, though had specifically notified the 1 billion user accounts it thought were compromised.
Yahoo has now sent emails to the additional 2 billion users believed to be affected.
The news of the breach last December followed its warning just months earlier that it had been hit by a “state-sponsored attack” in 2014, in which it lost the details of at least half a billion users, including eight million from the UK.
Yahoo said forensic experts discovered the new information relating to the hack after it was folded into the AOL brand, under the new name Oath.
The price Verizon paid for the Yahoo businesses was cut by $350m after both the 2013 and 2014 data breaches were revealed.
The remainder of Yahoo, which Verizon did not buy, comprised of stakes in the Chinese retailer Alibaba and Yahoo Japan, and was renamed Altbaba.