An independent security analyst found that a page since removed had been altered to trick visitors into installing malware when they attempted to view it.
The assessment, based on new intelligence obtained after the $4.5 billion acquisition, compares with the firm's initial estimate that 1 billion accounts were compromised.
Scant details so far released by the firm omit some of the most important elements of the intrusion and what the company has since learned about the hackers' tactics and motives.
Stolen information on 21 million individuals, including Social Security numbers and 5.6 million fingerprints, from a massive 2015 hack doesn’t appear to have been dispersed yet.
Brian Krebs, an independent journalist who investigates breaches, reported that the attack led to a “fire sale” on millions of stolen credit- and debit-card accounts.
