The leak disclosed in September involved about 500 million user credentials and took place in late 2014. The December disclosure concerned account details of a billion users and occurred in August 2013.
On Wednesday US time, the company said in a statement that the breach had come to light during an investigation into the billion-account breach it had announced in December.
The two breaches reported last year have caused a delay in the finalisation of the sale of some of Yahoo!'s assets to Verizon.
A message sent to Yahoo! users on Wednesday read: "Based on the ongoing investigation, we believe a forged cookie may have been used in 2015 or 2016 to access your account."