Apple has resolved an issue with the Hide My Email feature that revealed users' actual email addresses.
Here’s how the flaw in Apple's Hide My Email resulted in the leaking of real addresses for over a year, and why it was only rectified after the issue became public knowledge.
It appears that the "Hide" aspect of Hide My Email was not functioning as effectively as promised, a topic I discussed earlier in July. Security researcher Tyler Murphy identified the flaw in June 2025, but even though Apple asserted it was fixed by March 2026, independent evaluations revealed it was still vulnerable, at least until July 3, 2026.
So, how did this issue manifest?
The flaw allowed anyone sending an email to your concealed address—regardless of it being spam or a legitimate message—to inadvertently expose your true email address in the sender’s mail logs.
You wouldn’t even realize it had occurred, as bounced messages don’t arrive in your inbox for you to notice. Murphy initially brought the issue to Apple’s attention in June 2025. Apple claimed the problem was resolved in March 2026, but that wasn’t accurate. Fast forward to early July, and 404 Media broke the story.
Apple implemented a genuine fix just two days later, on July 3. You can draw your own conclusions based on that timeline. "The bug that caused Apple’s Hide My Email to leak hidden email addresses to senders has been resolved," reported 404 Media.
Is the problem completely fixed?
However, the outlet cautions that email addresses associated with Hide My Email aliases, particularly those created before July 7, 2026, may still exist in retained third-party mail logs. Furthermore, Apple is currently facing a class-action lawsuit alleging the company violated California consumer protection laws by marketing a feature that did not function as advertised.
This behavior, of quietly acknowledging a problem internally while claiming to reporters that it has been resolved when it hasn’t, mirrors criticisms about Apple’s App Store moderation only responding to public outcry.
Privacy features promoted as premium aspects face increased scrutiny, and the pending class action means Apple’s management of the situation could be as significant as the fix itself.
Other articles
Apple has resolved an issue with the Hide My Email feature that revealed users' actual email addresses.
A vulnerability in Hide My Email revealed actual addresses through returned spam messages for more than a year before Apple fixed it, just days after it became public knowledge.
