Does Zoho Mail really has a history of security vulnerabilities?

Tsunami · 13 May 2026, 03:08 AM

According to Wikipedia, Zoho has shown several serious security issues in the last years. See article.

This surprises me, because when I read articles about security-focused providers, Zoho is often mentioned as very reliable and focused on security and privacy. They are often the one "big" player included in such lists, next to the ones like Proton, Posteo, Mailbox.org ...

Also, more and more Indian politicians switch to Zoho, which I guess they wouldn't do if their email service would be having security concerns?

I was close to opening a Zoho mail account, but I wouldn't bother if they have a reputation of security issues.
But did anyone else hear about this or experience these?

Most articles about secure and privacy-focused providers are actually praising Zoho Mail.

Avion · 13 May 2026, 04:06 AM

Quote:

Originally Posted by Tsunami

I was close to opening a Zoho mail account.

Really? Your quota of reviews was fulfilled?

Quote:

Originally Posted by Tsunami

I wouldn't bother if they have a reputation of security issues.
But did anyone else hear about this or experience these?

I had heard about some security issues, but then again I've heard issues mentioned with other providers over the years too.

I've used Zoho Mail for many years, got some old legacy accounts that I can still use IMAP/SMTP for free and to host my own domains. I also have a paid account with their EU-based server. For the price and for what it includes (by the way, you're not forced to use their 'extras') I consider them excellent value.

Chicken Little's opinion may differ.

alexbuzaev75 · 27 May 2026, 02:36 AM

Every major email provider has had security incidents at some point ? Google, Microsoft, Proton, even Fastmail have all dealt with vulnerabilities or outages. What matters more is how quickly the provider responds, whether they disclose issues transparently, and what their track record looks like in recent years.

From what I've read, most of the issues attributed to Zoho on Wikipedia are several years old and were patched relatively quickly. I haven't seen any recent large-scale breach of their mail service specifically. The fact that they self-host their infrastructure (rather than relying on AWS/Azure like many competitors) is actually a plus from a data-sovereignty perspective.

That said, "secure" and "private" aren't the same thing. Zoho is a commercial provider based in India and the US, so if your concern is government access or zero-knowledge encryption, Proton or Mailbox.org would be a better fit. If your concern is general account safety, enable 2FA and Zoho is as solid as most mainstream providers.

I'd say: don't let a Wikipedia list of historical CVEs scare you off ? read the actual incidents and decide if they're relevant to your threat model.

ankupan · 27 May 2026, 10:31 PM

Zoho is strong player in email hosting, they have improved a lot.

Using their email hosting for personal and business purposes too.

Support is quicker and adding new feature quickly.

They are hosting India Govt email accounts. (2 Million accounts). it means they fulfil all requirements.

https://www.thehindu.com/news/nation...le70155315.ece

https://www.zoho.com/blog/workplace/...c-for-goi.html

Tsunami · 2 Jun 2026, 04:08 AM

Quote:

Originally Posted by alexbuzaev75

Every major email provider has had security incidents at some point ? Google, Microsoft, Proton, even Fastmail have all dealt with vulnerabilities or outages. What matters more is how quickly the provider responds, whether they disclose issues transparently, and what their track record looks like in recent years.

From what I've read, most of the issues attributed to Zoho on Wikipedia are several years old and were patched relatively quickly. I haven't seen any recent large-scale breach of their mail service specifically. The fact that they self-host their infrastructure (rather than relying on AWS/Azure like many competitors) is actually a plus from a data-sovereignty perspective.

That said, "secure" and "private" aren't the same thing. Zoho is a commercial provider based in India and the US, so if your concern is government access or zero-knowledge encryption, Proton or Mailbox.org would be a better fit. If your concern is general account safety, enable 2FA and Zoho is as solid as most mainstream providers.

I'd say: don't let a Wikipedia list of historical CVEs scare you off ? read the actual incidents and decide if they're relevant to your threat model.

Zoho is based in India. I don't know what the US has to do with this (or the EU for that matter)? Zoho is Indian, this is also why local government workers are massively switching to Zoho, because it is a local product.

Security and privacy are two different things indeed. However, according to the (many) articles I read about these issues, Zoho scores well on both security and privacy.
Of course articles can contain mistakes, but some articles about this subject recommend Zoho alongside Tuta, Proton, Posteo, ...

jarland · 4 Jun 2026, 04:52 AM

I've never spoken with a single person who told me that their security was compromised through Zoho. That's not necessarily worth much, but I'm in a fairly strong position to have had that conversation at least once. I consider it noteworthy enough that I would say it out loud.

Tsunami · 9 Jun 2026, 01:22 AM

On this forum, Zoho has had excellent reviews too.

And they are not US-based, they're Indian. This is why the Indian government uses their services a lot, they want to use and support a local provider.

The only thing I wonder: is Zoho Mail a stand-alone product they offer? Or are you obliged to also use the other products Zoho company offers? For me it's mainly the email that matters. Like with Proton and Gmail, I don't like that you're connected to so many other services because you decide to use their email product. I like email without many other services attached. But if Zoho allows to only use Zoho Mail while ignoring the other products the company has, then I'm very tempted to try. Because I heard and read a lot of praise about them.

ankupan · 9 Jun 2026, 02:04 AM

I have been using Zoho Mail for almost 10+ years.

Very reliable, quick chat support.

Yes, Zoho Mail is an independent product too. I am using it only. No Bundle.

Yes, they are in India, but their servers are in many countries, and my emails are on their USA global server.

Quote:

Originally Posted by Tsunami

On this forum, Zoho has had excellent reviews too.

And they are not US-based, they're Indian. This is why the Indian government uses their services a lot; they want to use and support a local provider.

The only thing I wonder: is Zoho Mail a stand-alone product they offer? Or are you obliged to also use the other products Zoho company offers? For me it's mainly the email that matters. Like with Proton and Gmail, I don't like that you're connected to so many other services because you decide to use their email product. I like email without many other services attached. But if Zoho allows to only use Zoho Mail while ignoring the other products the company has, then I'm very tempted to try. Because I heard and read a lot of praise about them.

Tsunami · 27 Jun 2026, 01:10 AM

Quote:

Originally Posted by ankupan

I have been using Zoho Mail for almost 10+ years.

Very reliable, quick chat support.

Yes, Zoho Mail is an independent product too. I am using it only. No Bundle.

Yes, they are in India, but their servers are in many countries, and my emails are on their USA global server.

It sounds good. Out of curiosity I clicked the sign-up button (I didn't complete registration yet) and I am assigned a zohomail.eu address. So I guess if I'd open the account, my emails would be on European servers and thus subject to GDPR and the reliable European privacy laws?

That Zoho Mail is a separate product from the other stuff they offer, is good. This is what I dislike a bit about Gmail and even Proton: you cannot choose to just have reliable email, without all the other stuff I don't need. This is why I chose Tuta as my paid email account, because they offer just very solid email with only calendar and address book as other stuff included in the package.

Zoho also seems to offer Yubikey as option for 2FA. So from all I read here and on other sites, it sounds very good. Will probably sign-up soon!

I'm very satisfied with Tuta, but need one additional mailbox. I'd like to stick to 1 paid account only, but it seems Zoho fulfills my requirements.

13 May 2026, 03:08 AM	#1
Tsunami The "e" in e-mail Join Date: Jun 2004 Location: in between the bright lights and the far unlit unknown Posts: 2,622	Does Zoho Mail really has a history of security vulnerabilities? According to Wikipedia, Zoho has shown several serious security issues in the last years. See article. This surprises me, because when I read articles about security-focused providers, Zoho is often mentioned as very reliable and focused on security and privacy. They are often the one "big" player included in such lists, next to the ones like Proton, Posteo, Mailbox.org ... Also, more and more Indian politicians switch to Zoho, which I guess they wouldn't do if their email service would be having security concerns? I was close to opening a Zoho mail account, but I wouldn't bother if they have a reputation of security issues. But did anyone else hear about this or experience these? Most articles about secure and privacy-focused providers are actually praising Zoho Mail.

27 May 2026, 02:36 AM	#3
alexbuzaev75 Junior Member Join Date: May 2026 Posts: 4	Every major email provider has had security incidents at some point ? Google, Microsoft, Proton, even Fastmail have all dealt with vulnerabilities or outages. What matters more is how quickly the provider responds, whether they disclose issues transparently, and what their track record looks like in recent years. From what I've read, most of the issues attributed to Zoho on Wikipedia are several years old and were patched relatively quickly. I haven't seen any recent large-scale breach of their mail service specifically. The fact that they self-host their infrastructure (rather than relying on AWS/Azure like many competitors) is actually a plus from a data-sovereignty perspective. That said, "secure" and "private" aren't the same thing. Zoho is a commercial provider based in India and the US, so if your concern is government access or zero-knowledge encryption, Proton or Mailbox.org would be a better fit. If your concern is general account safety, enable 2FA and Zoho is as solid as most mainstream providers. I'd say: don't let a Wikipedia list of historical CVEs scare you off ? read the actual incidents and decide if they're relevant to your threat model.

27 May 2026, 10:31 PM	#4
ankupan Cornerstone of the Community Join Date: Apr 2004 Posts: 835	Zoho is strong player in email hosting, they have improved a lot. Using their email hosting for personal and business purposes too. Support is quicker and adding new feature quickly. They are hosting India Govt email accounts. (2 Million accounts). it means they fulfil all requirements. https://www.thehindu.com/news/nation...le70155315.ece https://www.zoho.com/blog/workplace/...c-for-goi.html

4 Jun 2026, 04:52 AM	#6
jarland Essential Contributor Join Date: Apr 2014 Posts: 410 Representative of: MXRoute.com	I've never spoken with a single person who told me that their security was compromised through Zoho. That's not necessarily worth much, but I'm in a fairly strong position to have had that conversation at least once. I consider it noteworthy enough that I would say it out loud.

9 Jun 2026, 01:22 AM	#7
Tsunami The "e" in e-mail Join Date: Jun 2004 Location: in between the bright lights and the far unlit unknown Posts: 2,622	On this forum, Zoho has had excellent reviews too. And they are not US-based, they're Indian. This is why the Indian government uses their services a lot, they want to use and support a local provider. The only thing I wonder: is Zoho Mail a stand-alone product they offer? Or are you obliged to also use the other products Zoho company offers? For me it's mainly the email that matters. Like with Proton and Gmail, I don't like that you're connected to so many other services because you decide to use their email product. I like email without many other services attached. But if Zoho allows to only use Zoho Mail while ignoring the other products the company has, then I'm very tempted to try. Because I heard and read a lot of praise about them.