SAN FRANCISCO — Yahoo has discovered a 3-year-old security breach that enabled a hacker to compromise more than 1 billion user accounts, breaking the company’s own humiliating record for the biggest security breach in history.

The digital heist disclosed Wednesday occurred in August 2013, more than a year before a separate hack that Yahoo announced nearly three months ago. That breach affected at least 500 million users, which had been the most far-reaching hack until the latest revelation.

“It’s shocking,” security expert Avivah Litan of Gartner Inc.

Both lapses occurred during the reign of Yahoo CEO Marissa Mayer, a once-lauded leader who found herself unable to turn around the company in the four years since her arrival. Earlier this year, Yahoo agreed to sell its digital operations to Verizon Communications for $4.8 billion – a deal that may now be imperiled by the hacking revelations.

Two Hacks, More Than a Billion Accounts

Yahoo didn’t say if it believes the same hacker might have pulled off two separate attacks. The Sunnyvale, California, company blamed the late 2014 attack on a hacker affiliated with an unidentified foreign government, but said it hasn’t been able to identify the source behind the 2013 intrusion.

Yahoo has more than a billion monthly active users, although some have multiple accounts and others have none at all. An unknown number of accounts were affected by both hacks.

In both attacks, the stolen information included names, email addresses, phone numbers, birthdates and security questions and answers. The company says it believes bank-account information and payment-card data were not affected.

But hackers also apparently stole passwords in both attacks. Technically, those passwords should be secure; Yahoo said they were scrambled twice – once by encryption and once by another technique called hashing. But hackers have become adept at cracking secured passwords by assembling huge dictionaries of similarly scrambled phrases and matching them against stolen password databases.

That could mean trouble for any users who reused their Yahoo password for other online accounts. Yahoo is requiring users to change their passwords and invalidating security questions so they can’t be used to hack into accounts. (You may get a reprieve if you’ve changed your password and questions since September.)

Security experts said the 2013 attack was likely the work of a foreign government fishing for information about specific people. One big tell: It doesn’t appear that much personal data from Yahoo accounts has been posted for sale online, meaning the hack probably wasn’t the work of ordinary criminals.

That means most Yahoo users probably don’t have anything to worry about, said J.J. Thompson, CEO of Rook Security.

Questions for Verizon

News of the additional hack further jeopardizes Yahoo’s plans to fall into Verizon’s arms. If the hacks cause a user backlash against Yahoo, the company’s services wouldn’t be as valuable to Verizon, raising the possibility that the sale price might be re-negotiated or the deal may be called off. The telecom giant wants Yahoo and its many users to help it build a digital ad business.

After the news of the first hack broke, Verizon said it would re-evaluate its Yahoo deal and in a Wednesday statement said it will review the “new development before reaching any final conclusions.” Spokesman Bob Varettoni declined to answer further questions.

At the very least, the security lapses “definitely will help Verizon in its negotiations to lower the price,” Litan predicted. Yahoo has argued that news of the 2014 hack didn’t negatively affect traffic to its services, strengthening its contention that the Verizon deal should be completed under the original terms.

“This just adds to fuel to the fire and it won’t help Yahoo’s cause,” said Eric Jackson, a longtime critic of the company’s management. Although he has in the past, Jackson doesn’t currently own Yahoo stock.

Investors appeared worried about the Verizon deal. Yahoo’s shares fell 96 cents, or 2 percent, to $39.95 after the disclosure of the latest hack.

Story: Michael liedtke

BEIRUT — First came the distress calls from doctors in underground shelters and morgues. Then residents under relentless bombardment in the few remaining blocks under rebel control in Aleppo began posting emotional goodbyes on social media and in widely circulated messages.

They wanted to have the final say in the merciless civil war.

“There is a problem with this planet,” said Monther Etaky, a 28-year old graphic designer. “This planet doesn’t want people to live as free or to live as humans.”

The world’s view of the Syria conflict has been largely driven by YouTube, Twitter and Facebook— making it one of the world’s most documented wars through amateur videos and coverage. This has given the activists a major role in chronicling the war, and in lobbying for the world’s response.

Nearly six years into the conflict, they complained the world has been looking the other way.

“Why is this silence? People are being eliminated,” tweeted Abdulkafi Alhamdo, an English teacher who has been a vocal critic of President Bashar Assad’s government. Then, he wrote: “The last (message). Thanks for Everything. We shared many moments. The last tweets were from an emotional father. Farewell #Aleppo.”

Alhamdo later went live on the video-streaming Periscope to say government troops were approaching. “I hope you can remember us,” he said.

A local aid worker, who gave only his first name, Omar, sent an emotional recorded message that was widely shared on Whatsapp.

“The government forces are at the end of the street. Forgive us,” he said in issuing a tormented apology for failing to protect the rebel enclave, once seen as the jewel of Syria’s rebellion.

After four years of holding onto nearly half of what was once Syria’s largest city and commercial center, thousands of residents of rebel-held Aleppo had been cornered in a one-square-mile sliver of land for days as Syrian government troops, backed by Russia, resisted calls for a cease-fire, pushing into the territory as rebel defenses crumbled.

Hospitals were knocked out and civil defense vehicles were bombed. Thousands of residents fled to government areas, but thousands more, likely die-hard government opponents, squeezed with the rebels into the ever-shrinking enclave.

Etaky said the fast buckling of rebel defenses shocked him at first.

“But when I turned on my brain and thought about what is happening and the cause of what is happening, I knew,” he said.

After months of siege imposed since July the rebels had no more power to go on, he said. With their families trapped in the city with them, many fighters left the front lines to tend to their relatives’ safety.

But most importantly, he said, “it was the world silence.”

Etaky said that as a witness of the grueling war, he thought he had become numbed by the violence years earlier. Since moving to the rebel-held sector in 2012, he said he had lost about 50 friends.

“When I was saying the last goodbyes, this was the first time I was affected because it was the last time,” he said.

He said he was proud of his role in documenting the war. There was no record, he said, of previous Syrian government crackdowns, including in the 1980s in Hama and Aleppo.

“If my son grows up and just explores the internet he can see his father, and what he was documenting and be proud that his father was a hero,” Etaky said, choking back tears.

Speaking to the Associated Press shortly after a cease-fire was announced late Tuesday, he added: “It is quiet in Aleppo right now. And it looks so sad to be saying goodbye to its residents, who will leave it forever.”

Story: Sarah El Deeb