Apple has addressed a year-old vulnerability in its “Hide My Email” privacy feature, which could expose users’ real email addresses. This incident has already led to a class action lawsuit and increased scrutiny of Apple’s privacy claims.
Hide My Email, part of the paid iCloud+ subscription, allows users to generate random alias addresses that forward emails to their real inboxes.
This feature is designed to decouple online identities from primary email accounts. Security researcher Tyler Murphy, co-founder of EasyOptOuts, discovered that these aliases could be reliably linked back to the real email addresses, undermining the anonymity that the feature was intended to provide.
In limited volunteer testing, Murphy reported that 100% of sampled Hide My Email aliases were exploitable, indicating that the issue was systemic rather than an isolated case.
Hide My Email Vulnerability Exposed
According to Murphy and EasyOptOuts co-founder Ben Weiner, exploiting this vulnerability did not require elevated privileges or insider access; it only needed carefully crafted email traffic.
Specifically, if a message sent to a Hide My Email alias was rejected as spam, the real, hidden address could appear in mail transfer logs kept by major email providers.
Since these bounce events usually happen before messages reach the users’ inboxes, affected Hide My Email customers had no reliable way to check spam folders or mail logs to see if their real addresses had been exposed.
Murphy first reported the flaw to Apple in June 2025. The company acknowledged investigating the issue multiple times and even claimed to have fixed it, but the vulnerability persisted.
Apple ultimately deployed a server-side patch on July 3, 2026, after media coverage highlighted the ongoing risk. The company now asserts that the bug has been fully resolved.
However, EasyOptOuts advises users to assume that any Hide My Email alias created before July 7, 2026, may have had its corresponding real email address logged by third-party mail providers and might still exist in those logs.
Apple is now facing a proposed class action lawsuit in California, alleging false advertising and deceptive conduct. The lawsuit claims that the company charged for iCloud+ while promoting Hide My Email as a strong privacy control, despite knowing about the vulnerability for over a year.
The complaint seeks reimbursement of subscription fees and an injunction requiring Apple either to deliver the promised privacy protections or to disclose the feature’s technical limitations clearly, as reported by 404 Media.
For security-conscious users, this case highlights the necessity of treating vendor “privacy” branding as marketing claims that must be verified. It also underscores the need to assume that email aliases and forwarding services can leak metadata or identifiers through infrastructure-layer logging, even when application-layer behavior appears private.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
