I have a friend who works in Yahoo and claims that he can hack into anyone's email. Is that really true?

I know its a vague question but I want to know if employees of Yahoo and Google have access to some database through which they can hack into others' email.

  • 4
    Just to add to all the answers: worrying about one's email is probably paranoid, considering that most bank employees can access your account data just as easily - and in that case, ALL data is sensitive.
    – UncleZeiv
    Feb 20 '12 at 16:10


A rouge employee willing to endanger their career/freedom (jail time) with correct access/motivation could illegally access email.

It has happened

I'll use Google as the example here because it actually happened in 2010 where there were 2 alleged employee that breached policy and read emails/chat:

Google acknowledged Wednesday that two employees have been terminated after being caught in separate incidents allegedly spying on user e-mails and chats.

So the same thing could happen at Yahoo, or Microsoft, or any other type of provider that has some kind of administrator access to the infrastructure.

Protect yourself

Never send anything sensitive via email, including (but not limited to) Credit Card info, passwords, your most private deep dark thoughts.

You can encrypt your email if paranoid, but this is not a trivial task:

Having said all that, it's actually not a big worry

Unless an employee at the organisation hosting your email is likely to directly target you and your email, don't worry about it. If you believe you are a target, then you may want to consider reporting their threats of undertaking illegal activities to their employer.

Also there's usually only a few employees who actually have such authority/access to do such a task, from this article:

A small number of GMail related engineers have access to the servers as a matter of necessity to do their jobs; a very small number of people actually access the contents as a matter of necessity to do their jobs, and even then, almost always only the associated metadata.

  • 3
    I'd like to reiterate the last part of this response, if someone is threatening you, you need to report them to law enforcement and the employee's organization because public discussions, even if as innocent as this thread, are a huge deal to company's PR and Legal divisions Feb 20 '12 at 13:09
  • 3
    PGP or S/MIME encryption of mail is easy task. If not - change your e-mail client Feb 20 '12 at 14:44

It's not a "hack" if you own the database and can simply read it.

You should always assume that people who provide your email service read your email. They can do it, that's for sure.

If you don't feel comfortable with that, use encryption.

  • Is that really true? Is there no law that prevents them from doing it?
    – SAN
    Feb 20 '12 at 12:12
  • 3
    I'm pretty sure there is such a law. But laws are broken all the time. Feb 20 '12 at 12:23
  • 2
    This is a fundamental and important truth about all cloud services. The only way to ensure that someone won't abuse your data is to not give them access: either don't store it with them, or encrypt it first and don't give them the key. All the laws and promises in the world may be overruled by a government demand, a hack, or simple employee dishonesty. It can be reasonable to trust a service with your data, but you should know that it really comes down to trust. And that trust may have to extend to third parties, including the government, who can legally (or illegally) demand access. Feb 20 '12 at 14:18
  • @Aki If the Terms of Service says they can/may do it, and you agree to that TOS, then, well... (Their Privacy Policy may also get into it, see Raystafarian's answer)
    – Izkata
    Feb 20 '12 at 19:08

If the workers have access to the mail server - they can access your mail boxes altough mail boxes are usually encrypted as well as the database holding the credentials is usually encrypted unreversibly using normally SHA.

  • 3
    mail boxes are usually not encrypted Feb 20 '12 at 14:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.