AOL Mail is a webmail service operated by AOL, which Bending Spoons bought from Yahoo in January 2026. The service uses TLS transport encryption and offers 2-step verification, so an account with a unique password and 2-step verification is reasonably protected against takeover. The address is the weaker part of the picture: an AOL address created years ago has been in breach files since a 2014 incident affecting about 2.4 million people, and mail content was scanned for advertising under the Yahoo-era privacy policy.
Ownership and operation#
AOL Mail still operates as a standard webmail service in 2026. A guide to mail clients for AOL lists the published settings as imap.aol.com on port 993 with SSL for incoming mail and smtp.aol.com on port 465 with SSL for outgoing mail. No announcement ending IMAP access had been found as of November 2026. The service is free with advertising, with paid add-ons that remove ads. The settings are set out in aiemaily's guide to mail clients for AOL Mail.
Yahoo agreed in October 2025 to sell AOL to Bending Spoons, the Milan-based company behind Evernote, Meetup and WeTransfer. The deal closed on 2 January 2026 for $1.454 billion, and Bending Spoons co-founder Luca Ferrari estimated that AOL remains among the world's top ten email providers, with roughly 8 million daily visitors.
The 2014 data breach#
In April 2014 AOL noticed a large increase in spam sent from spoofed AOL addresses. Its investigation found unauthorised access to AOL's network and systems, and on 28 April 2014 the company published a security update confirming that information on a significant number of user accounts had been accessed. The exposed data included email addresses, postal addresses, address book contact information, encrypted passwords and encrypted answers to security questions, plus certain employee information.
AOL stated that there was no indication the encryption on the passwords or the security question answers had been broken, and no indication that encrypted financial information had been accessed. The company urged all users to change their passwords and their security questions as a precaution. Spammers had used the stolen contact information to send spoofed mail appearing to come from roughly 2% of AOL email accounts. At the time AOL had about 24 million email accounts and 2.5 million paid users, according to financial filings cited by CRN. Breach records put the number of affected individuals at about 2.4 million; AOL itself never published a final count, so the 2.4 million figure comes from breach records rather than from the company. AOL tightened its DMARC policy after the breach so that bulk AOL mail is rejected if it does not come from an AOL server.
Earlier incidents#
In 2006 AOL Research released a dataset of about 20 million search queries from more than 650,000 users for research purposes. The data was meant to be anonymised, but personally identifiable information was present in many queries, and the New York Times identified an individual from the released data by matching queries against phone book listings. The release led to resignations, sackings and a class action lawsuit settled in 2013, but copies of the dataset had already spread widely. Mailbird's guide to the Bending Spoons acquisition lists the release among the earlier incidents in AOL's history.
An earlier incident dates to 2003. In May of that year Jason Smathers, a software engineer at AOL, took a list of 92 million screen names and email addresses from AOL systems and sold it to a spammer. Federal prosecutors charged Smathers in June 2004, and in August 2005 he was sentenced to 15 months in prison after pleading guilty. The list was used to send large volumes of spam to AOL members.
AOL account security#
AOL Mail connects over TLS. Webmail runs over HTTPS, and the published IMAP and SMTP settings both require SSL, so mail is encrypted between the device and AOL's servers. That is transport encryption, not end-to-end encryption: AOL publishes no end-to-end encryption for AOL Mail, so mail is readable on AOL's servers and by anyone with lawful access to them.
Two-step verification is the main control available on the account. AOL's Account Security page offers 2-step verification by phone number, with the code sent by text message or by call, and by authenticator app. The authenticator-app option appears only on accounts with at least two recovery methods, a recovery phone number and a recovery email address, and AOL states the option is not yet available for all accounts. Third-party mail apps cannot ask for a code, so once 2-step verification is on, they need an app password generated on the Account Security page instead of the normal password.
AOL's Account Security page also shows recent account activity. Passkey support for AOL Mail is not verified in any source found, according to login.com's guide, which checked AOL's official help pages. The phone method works on every account, the authenticator method works on accounts that meet the recovery requirements, and both are stronger than a password alone.
Mail scanning and advertising#
In April 2018 Oath, then the Verizon-owned parent of AOL and Yahoo, published a unified privacy policy that stated Oath "analyzes and stores all communications content, including email content from incoming and outgoing mail". The policy also covered attachments and user content around interactions with financial institutions. The stated purpose was to deliver targeted advertising based on interests identified in the scans.
The Wall Street Journal reported that Oath scanned over 200 million inboxes and pitched advertisers on the ability to draw information from Yahoo Mail inboxes. Oath said the scanning applied to commercial mail from retailers and mass senders, and that users could opt out of interest-based advertising. The same reporting noted that Gmail stopped scanning mail for ad targeting in 2017, and that Microsoft Outlook states it does not use email content for ad targeting.
Yahoo's own privacy policy, last updated in April 2022, still states that Yahoo analyses and stores all communications content, including email content from incoming and outgoing mail, to deliver, personalise and develop features, content, advertising and services. Whether that policy still governs AOL Mail after the January 2026 sale is not confirmed in any public source found. No source found states whether AOL Mail scanning for advertising continues under Bending Spoons, so the current position is an open question rather than a confirmed fact.
The inherited address#
An address created in the 1990s or 2000s has been handed out to banks, shops, forums and mailing lists for decades, and the 2014 breach put many of those addresses, with postal addresses and contact lists, into criminal hands. A reader can check whether an address appears in known breaches through Have I Been Pwned, which aggregates breached records and offers notifications when an address appears in a future breach. The AliasFleet guide to checking whether an email was leaked explains how to read each breach the check names and what to do for each one.
Password reuse makes the exposure worse. If the same password that protected an AOL account in 2014 was also used on other sites, the encrypted password taken in the breach could be cracked offline and tried elsewhere. AOL's advice at the time was to change the password everywhere it had been reused, not only at AOL. The same logic applies now: an old address with an old password is a credential that has been exposed more than once.
| Aspect | Account | Address |
|---|---|---|
| Protection | Unique password and 2-step verification | A separate alias for each site, forwarding to AOL |
| Main risk | Takeover if the password is reused or 2-step verification is off | Presence in breach files since 2014 |
| Limit | Mail is readable on AOL servers; no end-to-end encryption is published | Aliases do not remove the address from breach files |
AliasFleet and an old AOL address#
AliasFleet is not a replacement for AOL Mail. The setup it is built for keeps AOL as the destination inbox and puts aliases in front of it. Each site gets its own alias address, and mail sent to that alias forwards to the AOL inbox. The AOL address itself is never handed out to a new site, so it stops spreading further. If one alias starts receiving spam, that alias can be paused or deleted without touching the inbox or any other alias. AliasFleet lists its current plans on its pricing page, and the docs explain how aliases and forwarding work.
The AOL address stays the destination inbox. Aliases sit in front of it, so a new site never receives the AOL address itself, and a leak of one alias exposes only that alias.
What AliasFleet does not do is also part of the picture. It does not encrypt mail end to end, it does not change AOL's mail scanning policy, and it does not remove an address from breach files. The AOL address still needs a unique password and 2-step verification turned on. The alias layer limits how far a new leak can travel; it does not repair the leaks that already happened.
The Gmail, Outlook, Yahoo, Zoho and GMX pieces in the same series each reach a similar split between account security and address safety. AOL is the oldest inbox in the set, and the address has been in circulation for decades.
