From Marketwatch:
Verizon Communications Inc. announced today that a 2013 hack into Yahoo’s network affected all Yahoo accounts, roughly 3 billion, after previous estimates said 1 billion accounts were affected.
From the Yahoo Help FAQ:
Based on an analysis of the information with the assistance of outside forensic experts, Yahoo has determined that all accounts that existed at the time of the August 2013 theft were likely affected
It is important to note that, in connection with Yahoo’s December 2016 announcement of the August 2013 theft, Yahoo took action to protect all accounts. The company required all users who had not changed their passwords since the time of the theft to do so. Yahoo also invalidated unencrypted security questions and answers so they cannot be used to access an account.”