Apple's 'Hide My Email' Flaw Exposes User Addresses Despite Year-Long Knowledge
A critical vulnerability in Apple's 'Hide My Email' feature allows users' real email addresses to be discovered, a flaw Apple has reportedly known about for over a year without a permanent fix.
✨ This content was summarized and interpreted by AI; it may contain errors — please verify accuracy with the original sources. Learn more
Listen to this story
A significant vulnerability in Apple's "Hide My Email" feature allows nearly anyone to discover a user's real email address, despite the company reportedly being aware of the flaw for over a year. This critical privacy lapse undermines a core function of Apple's iCloud+ service, designed to safeguard user anonymity and reduce spam.
The flaw was first identified and responsibly reported to Apple in June 2025 by Tyler Murphy, co-founder of EasyOptOuts, a data privacy firm. Despite Apple acknowledging the report and claiming in March 2026 to have "addressed the reported issue in a recent system change," Murphy's subsequent tests confirmed the vulnerability remained active. Frustrated by the lack of a permanent fix after more than twelve months, and Apple's request to withhold public disclosure, Murphy decided to go public to warn users. Independent verification by 404 Media further confirmed the exploit's functionality as recently as this week, with 100% of tested "Hide My Email" addresses proving exploitable. The exact technical details of the vulnerability are being withheld to prevent widespread malicious exploitation.
This ongoing issue carries substantial implications for user privacy. "Hide My Email" is a premium iCloud+ feature that generates unique, randomized email aliases, forwarding messages to a user's actual inbox without revealing their personal address. This is crucial for mitigating spam, protecting against data breaches, and preventing unwanted identification. However, the bug means that individuals relying on this feature for safety could have their real email addresses exposed, potentially linking to other personal details via publicly accessible people-search sites.
Apple's prolonged inaction on such a fundamental privacy flaw is concerning, especially for a company that frequently touts its commitment to user data protection. While Apple stated in May that it was "still investigating" and anticipated a fix "in the coming weeks," the delay erodes user trust in privacy features that are part of a paid subscription. Users should be wary of the current effectiveness of "Hide My Email" and consider alternative solutions until a definitive patch is confirmed and verified.