The incident is separate to the breach Yahoo disclosed back in September, which saw at least 500 million accounts compromised.
In other words, Yahoo got hacked twice — badly.
The company isn't providing many details about the breach, because right now, it doesn't know them. "The company has not been able to identify the intrusion associated with this theft," it said in a statement.
The company has emailed its users informing them of the breach — and if you're affected you're probably asking yourself what you can do now.
There are two answers: Protect your logins on other services, and delete your account.
1. Protecting your logins
It can't be said enough: You should use a strong, unique password for every website or service you have an account on. This means if any one service gets hacked, then your other accounts won't be compromised too.
Hackers will often trawl through user databases stolen in hacks, and try the stolen login details on other sites. This means if use a site that got hacked, and they got hold of your password, then you can be re-victimised over and over and over again.
Even Mark Zuckerberg gets hacked.David Ramos/Getty Images
This summer, we saw a spate of hacks of celebrities and high-profile figures on Twitter — everyone from Drake to Facebook CEO Mark Zuckerberg. Twitter itself wasn't hacked, but it looks like the victims re-used passwords on services that were, like LinkedIn and Tumblr.
So if you re-used the same password you used for your Yahoo account anywhere else, you should go ahead and change those accounts. Now.
Also: If it's available, activate two-factor authentication (2FA). It creates a second barrier to entry by sending a unique code to your phone, so even if an account's password is compromised, the attacker still can't get in unless they also have access to your phone (although there are some devious ways hackers try to get around it). It is available on Google, Facebook, Twitter, and most other major web services.
On a long enough timeframe, everyone gets hacked. But by having unique passwords and 2FA, you can limit the damage.
It'll ask you to enter your password, and to do a Captcha, to prove who you are — and just like that, you're done.
Once you confirm you want to delete your account, it'll take about 90 days to process. This is to stop people from maliciously or fraudulently deleting other people's accounts if they gain access — and it means if you get cold feet straight after, it's not too late.
This article is from Rob Price Business Insider UK http://uk.businessinsider.com/1-billion-yahoo-accounts-hacked-how-to-delete-your-account-change-passwords-2016-12
1 billion Yahoo accounts have been stolen in the biggest hack ever — here's what you should do