Apple Patches Hide My Email Flaw More Than a Year After It Was Reported

Apple has patched a security vulnerability in its iCloud+ Hide My Email feature that could expose the real email address behind a protected alias. The fix comes more than a year after security researcher Tyler Murphy, co-founder of EasyOptOuts, first reported the flaw to the company.



Hide My Email is a paid iCloud+ feature that creates random, anonymous email addresses which forward messages to a user's real inbox, helping keep a user's real email address private when signing up for websites or services. Murphy discovered that sending a specially crafted email that was rejected as spam could cause the recipient's real email address to appear in mail transfer logs.


The vulnerability did not expose passwords, Apple Accounts, or inbox contents. Instead, it undermined Hide My Email's core privacy promise by potentially allowing an alias to be linked back to a user's permanent email address.

Murphy first reported the issue to Apple in June 2025. Apple later said it had fixed the flaw in March 2026, but Murphy found it remained exploitable. After another unsuccessful fix attempt in late June, he contacted 404 Media, which published the story on July 1. Apple later said it deployed a patch on July 3, and both the company and the researchers now say the vulnerability has been resolved.

With the bug now patched, technical details have been disclosed. "We don't know how often hidden email addresses were leaked in email logs," Murphy and EasyOptOuts co-founder Ben Weiner said in a statement. "For many major email hosts, the leak was triggered simply by an email being automatically rejected as spam, even if it was a legitimate message. Such emails probably didn't make it to your inbox, so you can't review your spam folder to learn whether you were affected."

The researchers caution that the privacy risk is not entirely eliminated because mail transfer logs may retain exposed addresses. They recommend assuming that any Hide My Email alias created before July 7, 2026, could have had its associated real email address exposed and retained in third-party logs.


A proposed class-action lawsuit has also been filed against Apple, alleging the company violated California's false advertising law and other consumer protection statutes by continuing to market Hide My Email as protecting users' email addresses while charging for iCloud+ subscriptions despite allegedly knowing about the flaw. Plaintiffs are seeking refunds of subscription fees and an injunction against the alleged conduct.