Apple has fixed a security bug in its Hide My Email feature that allowed attackers to uncover the real email address linked to an Apple account. The company says it deployed a patch on July 3 and has fully resolved the issue.
Hide My Email is available to iCloud+ and Apple One subscribers. The feature creates random email addresses that forward messages to a user’s personal inbox, which helps people avoid sharing their main email address when signing up for websites, newsletters, or online services.
Don’t miss the best of The Mac Observer
Set us as a preferred source and our Apple reporting ranks higher in your Google Search results and Discover feed — one tap, no account changes.
404 Media recently reported that a vulnerability in the system allowed anyone to reveal the real email address behind a Hide My Email alias. The report also led to a proposed lawsuit over the privacy issue.
Apple later confirmed that it had patched the Hide My Email security bug earlier this month. The company said the fix now prevents people from using the vulnerability to access a user’s personal email address.
Security researcher Tyler Murphy first reported the issue to Apple in June 2025. Apple initially said it had fixed the problem, but Murphy later found that the vulnerability still worked.
The latest patch should now protect iCloud+ users who rely on Hide My Email to keep their personal email addresses private while using websites and online services.
Discussion