Yahoo has uncovered an attempt to hack into customers’ Yahoo Mail and ordered passwords be re-set on all affected accounts.

The company said the security attack had been a “coordinated effort to gain unauthorized access to Yahoo Mail accounts” and said it had taken immediate action to make affected users change their passwords.

Yahoo did not give exact information on when the attack took place. It said an investigation showed that “malicious computer software” used a list of usernames and passwords to access Yahoo Mail accounts.

“Based on our current findings, the list of usernames and passwords that were used to execute the attack was likely collected from a third-party database compromise. We have no evidence that they were obtained directly from Yahoo’s systems,” the company said in a statement posted to its Tumblr page.

Yahoo said the attackers attempted to get names and email addresses from victims’ sent emails.

The attack is the latest embarrassment for Yahoo, which was criticised after sending a flurry of tweets about the brief Gmail outage on Friday afternoon. Yahoo later apologised for the tweets, which it said “reflected bad judgement”.

In its statement, Yahoo said it was working with federal law enforcement to “find and prosecute the perpetrators responsible for this attack” and apologised to its users, saying, “We regret this has happened and want to assure our users that we take the security of their data very seriously”.

Earlier this month, a malware attack hit Yahoo's advertising server, reportedly affecting tens of thousands of users per hour. And in 2012, hackers posted login information for more than 450,000 Yahoo users online.