The disclosure triples earlier estimate of the size of the largest data-theft breach in history.
Lawyers said the number of legal claims by shareholders and Yahoo! account holders will soar as a result.
Yahoo!, bought for £3.38bn by Verizon Communications Inc in July, already faces at least 41 consumer class-action lawsuits in US federal and state courts.
John Yanchunis, a lawyer representing some of the affected users, said a federal judge who allowed the case to go forward still had asked for more information to justify his clients’ claims.
He said: “I think we have those facts now.
“It’s really mind-numbing when you think about it.”
Yahoo! bosses said last December that data from more than 1 billion accounts was compromised in 2013.
They said “recently obtained new intelligence” showed all user accounts had been affected and but believe the stolen information did not include passwords in clear text, payment card data, or bank account information.
Experts said the data was protected with outdated, easy-to-crack encryption and also included security questions and backup email addresses, which could make it easier to break into other accounts held by the users.
A Yahoo! official stressed the 3 billion figure included many accounts that were opened but that were never, or only briefly, used.
The revelation follows months of scrutiny by Yahoo, Verizon, cybersecurity firms and law enforcement that failed to identify the full scope of the 2013 hack.
David Kennedy, chief executive of cybersecurity firm TrustedSEC, said the investigation highlighted how difficult it was for companies to stay ahead of cyber-criminals even when they know their networks had been compromised.
He said: “Companies often do not have systems in place to gather up and store all the network activity that investigators could use to follow the hackers’ tracks.
“This is a real wake up call.
“In most guesses, it is just guessing what they had access to.”