Apple fixes Hide My Email flaw that exposed users' real email addresses: Report

Apple has fixed a vulnerability in its Hide My Email feature that could allow attackers to uncover a user's real email address, undermining one of the service's core privacy protections. According to 404 Media, the flaw remained unpatched for more than a year after it was first reported to Apple and was only fixed after the publication highlighted the issue earlier this month.

As part of iCloud+, Apple's Hide My Email feature lets users quickly generate anonymous email addresses that can be used to sign up for websites, online services or communicate over email without revealing their real address. The generated aliases typically consist of two random words followed by a number and the @icloud.com domain.

More from Tech

According to 404 Media, Apple has now fixed a vulnerability in the feature. In simple terms, the flaw could be exploited by sending a Hide My Email address an email that would be rejected as spam, potentially revealing information that was meant to remain private.

EasyOptOuts co-founder Tyler Murphy, who first disclosed the flaw to Apple, said the company initially informed him that it was investigating the issue. Apple later told Murphy that the vulnerability had been fixed in March 2026, but he found that it remained unpatched. Over the following months, Apple said it was continuing to investigate the problem, prompting Murphy to contact 404 Media after losing confidence that the issue would be resolved.

404 Media has since confirmed that Apple has patched the vulnerability and has now disclosed how the exploit worked, as it can no longer be abused. The flaw affected Hide My Email, an iCloud+ feature that allows users to generate anonymous email addresses for website sign-ups and email communications.

email logs generated before the fix may still contain users' real email addresses, leaving some previously exposed data at risk. Apple is also facing a proposed class-action lawsuit alleging that it misrepresented the privacy protections offered by Hide My Email. The plaintiffs claim Apple violated California's false advertising and consumer protection laws by continuing to market the feature despite allegedly knowing it did not function as advertised.