Yahoo told the Guardian that it first reported the cookie forging in a filing in November 2016 and outlined the issue in a security update in December 2016, although some users are only being notified this week.