Vice President Mike Pence used a personal AOL email account to conduct sensitive state business — including issues related to homeland security — as the governor of Indiana, according to a report from The Indianapolis Star. Not only that, but Pence’s email account was also compromised last year, the report reveals.

The revelations, based on emails obtained through requests for public records that were just now made available, severely undermines the Trump campaign and current administration’s efforts to paint Democratic candidate Hillary Clinton as a criminal for having used a private email server in her role as Secretary of State. Because personal email accounts are not subject to same types of public transparency laws, it’s up to the official and his or her transition staff to hand over any sensitive state-related messages for archiving. Emails from a state account are automatically stored on state servers and subject to public records requests.

An AOL account is noticeably less secure than a government-issued one

Pence’s office claims the contents of his personal AOL account used for state business are in fact in the process of being archived. "Similar to previous governors, during his time as governor of Indiana, Mike Pence maintained a state email account and a personal email account,” reads a statement given to the The Indianapolis Star. “As governor, Mr. Pence fully complied with Indiana law regarding email use and retention. Government emails involving his state and personal accounts are being archived by the state consistent with Indiana law, and are being managed according to Indiana’s Access to Public Records Act.”

A larger concern, however, is security. By using a private AOL account to conduct sensitive state matters, Pence could have exposed sensitive state business. In the hacking incident last year, Pence’s email account was compromised by a scammer who used it to try and extort money from members of his contact list by claiming Pence and his wife were stranded in the Philippines, The Indianapolis Star reports. This hack didn’t appear to have had been designed specifically to breach Pence’s office, which made clear that his AOL account could be compromised by relatively benign breaching techniques designed by spammers and low-level hackers.

It is not illegal in Indiana to own and use a personal account while in office, nor is it against the law to handle work-related matters from a personal account — so long as those emails are in some way archived. However, the Star reports that Pence made no efforts to preserve his AOL emails until after he left office and is only just now doing months after public records requests were first made.