Yahoo, already under a cloud from its summertime disclosure that 500 million user accounts had been hacked in 2014, disclosed Wednesday that another attack a year earlier had compromised more than 1 billion Yahoo accounts.

The newly disclosed attack involved more sensitive user information, including unencrypted security questions. Yahoo is forcing all of the affected users to change their passwords and it is invalidating the security questions.

Yahoo had agreed to sell its core businesses to Verizon Communications for $4.8 billion. Verizon said that it might seek to renegotiate the terms of the transaction after the first hacking was disclosed. It’s unclear how the newest information will affect its view of the purchase.