Apple finally fixes Hide My Email security flaw, a year after it was first discovered

Apple fixes Hide My Email bug that exposed anonymous addresses via returned spam logs
Blind emails created before July 7, 2026 may still be exposed in third-party logs
Users should update and consider regenerating hidden addresses to reduce the risk of persistent exposure.

A year after it was first discovered, a vulnerability in Apple’s Hide My Email feature has finally been fixed; However, some users will likely remain at risk until they also make changes on their part.

The Hide My Email feature is part of the paid iCloud+ offering and allows users to quickly create a new anonymous email address, very useful for people who don’t want to share their email with different products on the web. It is also important since some companies tend to sell this information to third parties who then, unsolicited, start sending spam emails and various offers.

In June 2025, security researcher Tyler Murphy found a way to link these anonymous emails to “real” addresses, rendering the entire service useless. He revealed his findings to Apple, who responded with a solution. However, the problem persisted and Murphy went back and forth with Apple, until he finally decided to go public.

Was it finally patched?

Now, it says the issue is finally resolved, but there are caveats:

“We don’t know how often email addresses hidden in email logs were leaked. For many major email servers, the leak was triggered simply because an email was automatically rejected as spam, even if it was a legitimate message. Such emails probably didn’t reach your inbox, so you can’t check your spam folder to see if you were affected,” he said.

Although the bug is now fixed, he believes the risk to Hide My Email users remains. “Because non-malicious emails can bounce, revealing your hidden email address, and because mail transfer records are often preserved, we would assume that any hidden email address linked to a Hide My Email address created before July 7, 2026 may have been exposed and could still be in third-party records.”

Apple released a working fix on July 3, 2026, and users were urged to update it immediately.

Through 404 Media