Reports reveal Apple’s Hide My Email bug lets attackers unmask users’ real email addresses

A newly reported bug in Hide My Email, Apple's paid iCloud+ feature, appears to allow users’ real email addresses to be exposed behind the disposable aliases meant to protect them. While the exact method has not been disclosed to prevent exploitation, the flaw reportedly lets someone connect a Hide My Email address back to the real inbox it forwards to, weakening the core privacy purpose of the feature. Security researcher Tyler Murphy first reported the issue to Apple in June 2025, and 404 Media says it later tested and verified the vulnerability. Murphy said every attempt to exploit the issue in his testing was successful, including volunteer trials where all tested Hide My Email addresses were reportedly exploitable. Apple told him in March 2026 that the issue had been addressed through a system change, but Murphy said the exploit still worked afterward. The company later said it was still investigating and expected to release a security update in the following weeks. The report add...