Yahoo stated, at the time it was aware of the hacker's assertion but rebuffed its legitimacy. The company since determined that the breach is genuine and that it's even worse than originally believed, Technology news website Recode reported Thursday, citing unnamed sources familiar with the investigation.

The announcement also has potentially bigger ramifications for the $4.8 billion sale of Yahoo's core business, at the center of this attack, to Verizon.

“Every day we receive hard data that demonstrates why we all must be on high alert when it comes to Internet security. From the everyday consumer to the largest enterprise, we are constantly under attack from people and organizations that want to profit from stealing our personal information. Only by changing the way we think about Internet security and deploying technology that provides full end-to-end coverage, will we be able to stop cybercriminals from profiting,” John Peterson, vice president/general manager, at Clifton, N.J.-based cybersecurity firm Comodo Enterprise, said.

Peterson added, “End users can help protect themselves by staying on top of their own password hygiene. They should use strong passwords – a combination of uppercase, lowercase and special characters – and make them longer than they'd like them to be.”