US telecoms firm Verizon says Yahoo's massive data breach could have a "material" impact on its deal to buy the internet firm.
It agreed to purchase the main parts of the business in July for $4.8bn (£4bn).
But since then Yahoo has revealed that hackers stole the data of about 500 million users in what could be the largest publicly disclosed cyber-breach in history.
Verizon could seek to reduce the price or walk away from the deal altogether.
A legal representative for Verizon, Craig Silliman, told reporters: "I think we have a reasonable basis to believe right now that the impact is material and we're looking to Yahoo to demonstrate to us the full impact. If they believe that it's not then they'll need to show us that."
He added that Verizon was "absolutely evaluating [the breach] and will make determinations about whether and how to move forward with the deal based on our evaluation of the materiality".
A clause in the agreement of the takeover purchase states that Verizon can withdraw if an event "reasonably can be expected to have a material adverse effect on the business".
In response, Yahoo said: "We are confident in Yahoo's value and we continue to work towards integration with Verizon."
The company said in September that the information had been "stolen by what we believe is a state-sponsored actor" but did not say which country it held responsible.
The breach included swathes of personal information, including names and emails, as well as “unencrypted security questions and answers”.
The hack took place in 2014 but has only now been made public. Yahoo recommended that all users change their passwords if they have not done so since 2014.