Yeah, J2O doesn't use SSL.

Though it's not inconceivable that other sites on the server do, and as such there *is* a non-zero chance that some data got leaked. If you want to be sure, change your password.