Yahoo and Equifax just proved that you can never trust the first number announced in a data breach