https://qz.com/1093399/the-equifax-efx-and-yahoo-hacks-are-further-proof-that-you-should-never-trust-the-first-number-announced-in-a-data-breach/

Within 24 hours, Yahoo and Equifax both announced that the figures they originally released about the number of people affected in their respective, record-breaking data breaches were incorrect. Both numbers were higher than originally thought.

The announcements fit a pattern in data breaches where companies announce an initial number of people affected, and add to that number later. We’ve charted that below, using announcements and follow-up announcements of some of the largest data breaches in recent years; Yahoo is left out of the chart because its massive scale (now 3 billion) dwarfs the others.