The probe began "following a significant increase in the amount of spam appearing as 'spoofed emails' from AOL Mail addresses," the Internet company said in a statement.
Spoofing is a tactic used by hackers to make it appear that the message is from an email user known to the recipient in order to trick the recipient into opening an attachment which may contain malware, AOL noted.
"AOL's investigation is still underway, however, we have determined that there was unauthorized access to information regarding a significant number of user accounts," the statement said.
"This information included AOL users' email addresses, postal addresses, address book contact information, encrypted passwords and encrypted answers to security questions that we ask when a user resets his or her password, as well as certain employee information."
The company added that "we believe that spammers have used this contact information to send spoofed emails that appeared to come from roughly two percent of our email accounts."
AOL said it was working with "best-in-class external forensic experts and federal authorities to investigate this serious criminal activity."
The statement said it was not known whether the encryption on passwords or answers to security questions was broken, but that "as a precautionary measure, we nevertheless strongly encourage our users and employees to reset their passwords used for any AOL service."
Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.
Samsung Galaxy Tab S10 Lite
Starts from ₹33,499
JBL New Live 780NC Wireless Headphones
Starts from ₹15,999
OPPO Reno 16
Starts from ₹61,999
Tecno Camon 50 Ultra 5G
Starts from ₹39,998
HP 303D Laser Single Function Monochrome Printer
Starts from ₹13,999
HP MFP 323DNW Laser Multi Function Monochrome Printer
Starts from ₹21,999