Yahoo says a giant data breach did not reveal the details of 1 billion accounts, it was more like 3 billion.

The company has tripled the number of account it says were affected by the August 2013 data theft.

It took the company until December 2016 to actually disclose the breach.

Yahoo says it obtained new intelligence from outside forensic experts following its acquisition by Verizon.

It claims passwords in clear text, payment card data and bank account information were not compromised, but that claim is likely to be met with cynicism given that it took the company 4 years to spot 2 billion breached accounts.

“Whether it's 1 billion or 3 billion is largely immaterial. Assume it affects you,” Sam Curry, chief security officer for Boston-based firm Cybereason, told reporters.

“Privacy is really the victim here.”

The disclosure is embarrassing for Yahoo’s new owner Verizon, which has just launched an ad campaign for Oath, a new company combining Yahoo and AOL services.