What's The Difference Between Yahoo's Data Breaches?

Yahoo! Inc. YHOO shares are down 4.2 percent in Thursday’s session after the company disclosed yet another massive user data breach. This new announcement comes about three months after Yahoo disclosed a previous large-scale data breach.

According to the company, the two breaches are completely separate incidents.

The breach that Yahoo revealed in September actually occurred back in 2014. The company reported that hackers gained access to the account information of at last 500 million users. Yahoo said the breach was a “state-sponsored act.” Hackers gained access to Yahoo users’ names, email addresses, telephone numbers, birth dates, encrypted passwords and even security questions.

On Wednesday, Yahoo disclosed details related to an entirely different breach that occurred in 2013. The latest hack was roughly twice the size of the one reported in September, impacting more than 1 billion Yahoo accounts. Once again, Yahoo reported that hackers gained access to data such as names, telephone numbers, dates of birth, encrypted passwords, and unencrypted account security questions.

Yahoo said the company became aware of the latest hack when law enforcement officials approached the company with data that an unnamed third party claimed contained hacked Yahoo user data.

According to Bob Lord, Yahoo’s chief security officer, the company doesn’t yet know how the 2013 hackers breached Yahoo’s systems.

Verizon Communications Inc. VZ, which agreed to buy Yahoo for $4.8 billion earlier this year, now says it's reviewing the situation before determining whether or not the latest breach could impact the merger.