An issue with iCloud+ left hidden email addresses easy to access, according to a report.
Apple has patched a vulnerability in iCloud+’s Hide My Email feature that made it possible to easily view the email addresses the service is designed to obscure, 404 Media reports. The publication first reported on the vulnerability in early July and revealed that Apple had been aware of the issue for at least a year. The company originally introduced Hide My Email as a way to generate dummy email addresses for added privacy in 2021.
According to 404, Apple says it deployed a software patch on July 3 that completely resolved the vulnerability. Before the company’s patch, it was reportedly possible to reveal an iCloud+ user’s email by sending a message to their Hide My Email-obscured address that’s rejected as spam. While that’s no longer possible, Tyler Murphy, co-founder of EasyOptOuts and the person who originally made 404 aware of the vulnerability, doesn’t think iCloud+ users’ emails are completely safe.
“The bug that caused Apple’s Hide My Email to leak hidden email addresses to senders has been fixed. However, we don’t think the risk to Hide My Email users has been eliminated,” Murphy said. “Because non-malicious emails could bounce, revealing your hidden email address, and because mail transfer logs are often retained, we’d assume that any hidden email address linked to a Hide My Email address created before July 7, 2026, may have been exposed and could still be in third-party logs.”
Engadget has contacted Apple to comment on the Hide My Email vulnerability. We’ll update this article if we hear back.
Murphy reportedly told Apple about this Hide My Email issue in June 2025. Over several months, the company looked into the vulnerability and claimed to fix it. After he was still able to find hidden email addresses, Apple again told Murphy it would look into the issue. In case the company decided to leave the vulnerability unpatched, Murphy then contacted 404 with what he discovered.
A large part of Apple’s modern public image is based on its commitment to privacy, so the idea that the company was selling a privacy-focused feature that didn’t work is naturally a problem. The issue hasn’t gone unnoticed. PCMag reports the company now faces a proposed class action lawsuit over the Hide My Email vulnerability that’s seeking an injunction against Apple’s “deceptive conduct” and full recovery of any subscription fees customers have paid for the feature.
