Apple has moved to address a security flaw in its Hide My Email service that enabled users’ real email addresses to be unmasked, effectively undermining the feature’s privacy guarantees.
404 Media reported Tuesday that a fix for the issue was deployed by Apple on July 3, 2026, after more than a year, when it was disclosed to the company by Tyler Murphy, co-founder of EasyOptOuts.
Hide My Email generates unique, random email addresses that forward messages to a user’s personal email inbox automatically. By creating disposable email addresses, the idea is to safeguard user privacy and tackle unwanted spam. The feature requires a paid subscription to iCloud+ and was announced by Apple in June 2021.
However, at the start of the month, details emerged of a flaw that made it possible to unmask a user’s real email address hidden behind a Hide My Email address. The issue was first reported to Apple on June 13, 2025, with Apple unsuccessfully attempting to patch it earlier this March and again on June 30, 2026.
Although specifics about the issue were withheld at that time to avoid potential exploitation, more details have now been published given it has been finally plugged.
The crux of the problem was that simply sending a targeted Hide My Email user a message that got rejected as spam caused the person’s real email address to appear in email logs.
“We don’t know how often hidden email addresses were leaked in email logs. For many major email hosts, the leak was triggered simply by an email being automatically rejected as spam, even if it was a legitimate message. Such emails probably didn’t make it to your inbox, so you can’t review your spam folder to learn whether you were affected,” Murphy and EasyOptOuts co-founder Ben Weiner told 404 Media.
It bears noting that while the bug has been resolved, it’s possible that a real email address linked to a Hide My Email address created before July 7, 2026, may have been captured in mail transfer logs when non-malicious emails get bounced.
The development comes as Apple is facing a class action lawsuit, accusing it of misleading customers about the privacy of its Hide My Email feature while charging for it.
“Apple promised Hide My Email as a privacy feature customers paid for, whether directly through iCloud+ or indirectly through Apple’s product-wide privacy representations, and failed to deliver it,” according to the complaint. “Worse, Apple has been fully aware of this problem for over a year and has not fixed it.”
“At no point during this period did Apple disable or pause Hide My Email, warn its customers of the flaw, or correct its privacy representations.”
