Apple’s Hide My Email Still Exposes Real Addresses More Than a Year After Disclosure

*A flaw in the iCloud privacy feature can reveal the underlying email address it is supposed to conceal, and Apple has not fixed it despite a report filed over a year ago.*

404 Media reported that the Hide My Email service leaks the real addresses tied to its generated aliases. The publication verified the issue with one of its own hidden addresses and chose not to publish the exact reproduction steps because the flaw remains active.

Tyler Murphy, co-founder of EasyOptOuts, discovered the problem and sent replication instructions to Apple more than twelve months before the July 2026 disclosure. Murphy stated that users deserve to know the risk that attackers may discover their hidden addresses. 404 Media confirmed the same behavior independently.

The two source reports contain no further technical description of the flaw and no indication that Apple has responded publicly or issued a timeline for a fix.

Why it matters

Users adopt Hide My Email precisely to avoid exposing their primary address to services they do not fully trust. When the mechanism itself can be turned against them, the feature stops providing the protection it advertises. Apple’s continued silence after more than a year leaves those users exposed without a clear path to mitigation.

---

Sources:

• Daring Fireball
• 404 Media

{
  "excerpt": "A still-unpatched flaw in Apple’s Hide My Email can reveal the real addresses the feature is meant to hide, more than a year after the issue was reported.",
  "suggestedSection": "security",
  "suggestedTags": ["apple", "icloud", "privacy", "vulnerability"],
  "imagePrompt": "An abstract arrangement of sealed envelopes floating above a dark reflective surface, with faint light leaks escaping from their edges. muted color palette, cinematic lighting, 16:9"
}