Facebook has said information on up to 87 million users, mostly in the US, has been "improperly shared" with Cambridge Analytica.
The social networking giant buried the new figure in a statement, posted Wednesday.
The figure is up by almost double the initial reported figure. It was believed that as many as 50 million people were affected by the data collection, though Facebook had initially said only 270,000 users were affected.
Facebook chief executive Mark Zuckeberg later said on a press call that the figure was a "conservative estimate" of users who could be affected by the Cambridge Analytica scandal, noting that the figure "could be less."
The company added in the statement that it was making changes to how apps connecting through the site can collect on users.
Read more: Trump-linked data firm Cambridge Analytica harvested data on 50 million Facebook profiles to help target voters | Data breach exposes Cambridge Analytica's data mining tools | How Cambridge Analytica used your Facebook data to help elect Trump | Cambridge Analytica: The future of political data is in the enterprise | Cambridge Analytica: 'We know what you want before you want it' | Election tech: The truth about the impact of political big data
Mike Schroepfer, Facebook's chief technology officer, outlined nine new ways the company will better protect user data, including limiting its groups, pages, and events API, used by developers to access attendance data; limiting which apps can request access to user check-ins, likes, photos, posts, and videos; and limiting what search results will return when users type in people's phone numbers.
The company also said it will deprecate Instagram's platform API later this year.
And, following another privacy controversy where Facebook users found that the Android app was collecting and uploading call and message logs, the company said it will limit the data uploaded. Facebook also said it will delete "all logs older than one year."
The site will also on Monday begin informing users if their data may have been "improperly shared" with Cambridge Analytica.
A former employee turned whistleblower revealed that Facebook's data privacy policies allowed for the London-based political analytics firm to collect data without consent.
The story erupted last month after Facebook announced that the data firm had been suspended from the social network for using the data for political profiling. The company is linked to Donald Trump's presidential campaign during the 2016 elections, and built voter profiles to help predict how people would vote at the ballot box.
Zuckerberg will testify to Congress on Wednesday to answer questions about privacy and how the company handles user data.
The firm was also involved in the so-called "Brexit" campaign in the run-up to the UK referendum on whether to leave the European Union.