Email Providers · Email Provider · Data breach
Yandex Mail
Headline
Yandex disclosed in 2021 that an EMPLOYEE with privileged access had been providing unauthorised access to user mailboxes - an insider incident rather than an external intrusion, and a category that no amount of…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Yandex disclosed in 2021 that an EMPLOYEE with privileged access had been providing unauthorised access to user mailboxes - an insider incident rather than an external intrusion, and a category that no amount of encryption-in-transit addresses. Insider access is the failure mode that consumer-facing security marketing almost never discusses, because the controls that would prevent it are internal and invisible. Layered on top is jurisdiction: Yandex operates under Russian law, including data-localisation requirements and state access provisions, which means the governing question for a non-Russian user is not the privacy policy but which state can compel what.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected, though Russian jurisdiction means US-style consumer arbitration frameworks likely don't apply the same way as for US-based providers in this tab.
Data sharing
CONFIRMED INSIDER BREACH (2021): Yandex disclosed that an EMPLOYEE had been providing unauthorized access to users' email accounts 'for personal gain' — a malicious-insider incident rather than an external hack, affecting almost 5,000 accounts. STRUCTURAL DATA-JURISDICTION FLAG: Yandex's own privacy policy explicitly states that for Russian users, personal data is stored on servers located WITHIN RUSSIA, and confirms Russia is a jurisdiction the European Commission has NOT recognized as providing 'adequate' data protection under EU standards — Yandex relies on Standard Contractual Clauses to justify EU-to-Russia data transfers for non-Russian users. Yandex's OWN privacy materials state email correspondence can only be accessed 'on the basis of an official court order' under Russian law, though independent verification of how consistently this is honored (especially amid Russia's post-2022 legal environment) was not possible this pass. SEPARATE 2023 SOURCE-CODE LEAK: in January 2023 an archive of about 44GB of Yandex source code was shared on a hacking forum; outside analyses of what it reveals about Yandex's analytics systems (e.g., Metrika, Crypta) were not verified this pass.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy yandex.com/legal/confidential/en/ | Not fetched yet | NO (HTML only) |
| Terms of service yandex.com/legal/rules/ | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.