Apple's Hide My Email Vulnerability Could Reveal Users' Real Email Addresses: Report

Apple's Hide My Email feature is designed to keep users' personal email addresses private, and it allows iCloud+ subscribers to generate unique email addresses that forward to their personal email account, rather than using their real email address. Now, a new report suggests that Hide My Email may not be protecting users' privacy. A vulnerability in the tool reportedly can expose users' primary email addresses. Apple was reportedly first informed about the vulnerability in 2025, but the company has yet to offer a fix. 

How the Hide My Email Flaw Works

As reported by 404 Media, Apple's Hide My Email feature has a security flaw that lets anyone discover a person's original email address, which the feature is supposed to hide. The vulnerability has existed for more than a year, even after being reported to Apple.

The flaw was discovered by Tyler Murphy, co-founder of the Easy Opt Out service, who said Apple has been aware of the issue since June 2025 and has yet to release a fix. The publication confirmed through its own testing that the issue was still exploitable as of June 30.

”Apple Hide My Email is leaking email addresses that are supposed to be hidden" Murphy told the publication. "We reported the issue and replication instructions to Apple over a year ago. We don't know why it hasn't been fixed, but we don't feel comfortable waiting any longer. Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses,” he added.

Murphy also claimed that the full scope of the issue was still unknown, but "100 percent" of the emails protected using Hide My Email feature could be exploited, as per "limited tests" with volunteers.

Apple reportedly acknowledged the issue the following month and said it was investigating. In March 2026, the company said to have informed Murphy that it had addressed the issue through a recent system update. However, Murphy found that the vulnerability had not been fixed and submitted additional details. Apple responded later that month that it was continuing to investigate. In May, the company again reportedly stated that the review was still ongoing.

Hide My Email is a feature to keep the personal email addresses of users private. This tool is available with iCloud+ subscriptions that start at 75 per month in India for 50GB. It makes different, unique, random @icloud.com email addresses that forward messages to a user's personal email account, so users don't have to share thier original email address when filling out forms or signing up for newsletters on the web.