Apple Patches Hide My Email Flaw a Year Later — Addresses Created Before July 2026 Still at Risk

Full text

Apple fixes Hide My Email flaw which exposed anonymous addresses through bounced spam logs

Hidden emails created before July 7, 2026 may still be exposed in third‑party logs

Users should update and consider regenerating hidden addresses to reduce lingering exposure risk

A year after first being discovered, a vulnerability in Apple’s Hide My Email feature has finally been fixed - however some users will probably remain at risk until they make changes on their end, as well.

The Hide My Email feature is part of the paid iCloud+ offering and allows users to quickly create a new, anonymous email address - very handy for people who don’t want to share their email with different products across the web. It is also important since some companies tend to sell this information to third parties who then, unsolicited, start sending spam emails and various offers.

In June 2025, security researcher Tyler Murphy found a way to link these anonymous emails to the “real” addresses, making the entire service useless. He disclosed his findings to Apple, who responded with a fix. However, the issue remained, and Murphy went back-and-forth with Apple, until finally deciding to go public.

Was it finally patched?

Now, he says the issue had finally been resolved, but there are caveats:

“We don't know how often hidden email addresses were leaked in email logs. For many major email hosts, the leak was triggered simply by an email being automatically rejected as spam, even if it was a legitimate message. Such emails probably didn't make it to your inbox, so you can’t review your spam folder to learn whether you were affected,” he said.

Even though the bug is now fixed, he thinks the risk to Hide My Email users remains. “Because non-malicious emails could bounce, revealing your hidden email address, and because mail transfer logs are often retained, we'd assume that any hidden email address linked to a Hide My Email address created before July 7, 2026, may have been exposed and could still be in third-party logs.”

Apple released a working fix on July 3 2026, with users urged to update immediately.

Via 404 Media