NEW YORK - Hillary Clinton may have violated federal records laws by using her personal email account for all messages when she worked as US secretary of state, The New York Times reported Monday.

Among other concerns, such personal emails are seen as less protected against the risk of hacking.

Clinton, an attorney, former first lady and former top US diplomat, is considered the officially undeclared frontrunner for her Democratic Party’s presidential nod in 2016. Hillary Clinton had no federal government email address during her four years at the State Department, the report said.  “Her aides took no actions to have her personal emails preserved on department servers at the time, as required by the Federal Records Act,” the Times said. That “may have violated federal requirements that officials’ correspondence be retained as part of the agency’s record.”

Government analysts cited in the report found the news “alarming.”

“It is very difficult to conceive of a scenario - short of nuclear winter - where an agency would be justified in allowing its cabinet-level head officer to solely use a private email communications channel for the conduct of government business,” said Jason Baron, an attorney at Drinker Biddle & Reath and an ex head of litigation at the National Archives and Records Administration.

A spokesman for Hillary Clinton, Nick Merrill, told the Times she had been “complying with the letter and spirit of the rules.” He did not elaborate.

The emails are required to be on government servers so that they can be researched; personal emails in contrast are not secure, and are understood to be used by federal officials in rare emergencies. Some exceptions may be made for confidential issues.

Clinton’s use of her personal email, however, was “exclusive ... for all of her (State Department) work,” the Times said.