Yahoo has confirmed that it knew for two years that a "state-sponsored actor" had hacked into its network.
It added that a panel of independent experts was now investigating exactly how much was known and by whom.
When Yahoo first disclosed the theft of millions of its users' details in September, it only made mention of a "recent investigation".
At the time, Verizon - which is buying part of Yahoo - said it had only been told of the breach ththat e same week.
In its latest filing to the Securities and Exchange Commission (SEC), Yahoo acknowledged the telecoms firm might now reconsider the $4.8bn (£3.9bn) takeover of its internet operations.
"As a result of facts relating to the security incident [Verizon] may seek to terminate the stock purchase agreement or renegotiate the terms of the sale," it said.
There had already been speculation that Yahoo had been aware of a problem for some time.
In September, the Wall Street Journal reported that the tech firm had detected a cyber-breach in the autumn of 2014 that it believed had been launched from computers in Russia. However, the paper said that its unnamed source did not know whether the two attacks were connected.
