404 Media has reported that Apple has finally addresses the vulnerability in Hide My Email that exposed a user’s real email address. Apple told them that the issue was fixed by a patch it released on July 3.
While the vulnerability was originally brought to Apple’s attention way back in June 2025, the company did not fix it until 404 Media informed the public of the bug earlier this month.
Hide My Email is an iCloud+ feature that allows users to generate random alias email addresses, hiding their real email address when signing up for online services or when emailing third parties. The feature is promoted as a way for a user to protect their real email address from spam, data breaches, and unwanted identification. Sending a Hide My Email user a message that got rejected as spam caused the person’s real email address to appear in email logs.
Tyler Murphy, co-founder of EasyOptOuts, discovered the issue and reported it to Apple back in June 2025, along information on how to replicate it. Apple acknowledged the report a month later and said it was investigating.
404 Media confirmed the vulnerability has been patched, and since the flaw can no longer be exploited, it has now shared details on how it worked.
“We don’t know how often hidden email addresses were leaked in email logs. For many major email hosts, the leak was triggered simply by an email being automatically rejected as spam, even if it was a legitimate message. Such emails probably didn’t make it to your inbox, so you can’t review your spam folder to learn whether you were affected,” Murphy and EasyOptOuts co-founder Ben Weiner said in a new statement.
“The bug that caused Apple’s Hide My Email to leak hidden email addresses to senders has been fixed. However, we don’t think the risk to Hide My Email users has been eliminated. Because non-malicious emails could bounce, revealing your hidden email address, and because mail transfer logs are often retained, we’d assume that any hidden email address linked to a Hide My Email address created before July 7, 2026, may have been exposed and could still be in third-party logs,” they added.
Keep in mind that while the bug has now been fixed, email logs that pre-date the fix could still contain information about users’ genuine email addresses.
Apple has been sued over the Hide My Email flaw, and the plaintiffs are seeking class action status. The lawsuit says Apple violated California’s false advertising law and other consumer protection statutes because Apple knew Hide My Email did not work as advertised.
Earlier this month, a California iPhone user filed what he hopes to become a class action lawsuit against Apple over a “Hide My Email” flaw that could expose a user’s real email address. The proposed class action lawsuit claims Apple violated California’s false advertising laws and other California consumer protection statutes due to offering a feature that it knows does not work as advertised.