A problem with iCloud+ made hidden email addresses easy to access, according to a report.
Apple fixed a vulnerability in iCloud+’s Hide My Email feature that made it easy to view email addresses that the service is designed to hide, 404 Media reports. The publication first reported on the vulnerability in early July and revealed that Apple had known about the issue for at least a year. The company initially introduced Hide My Email as a way to generate fake email addresses for added privacy in 2021.
According to 404Apple says it rolled out a software patch on July 3 that completely fixed the vulnerability. Before the company’s patch, it was apparently possible to reveal an iCloud+ user’s email address by sending a message to their hidden Hide My Email address which is rejected as spam. Although this is no longer possible, Tyler Murphy, co-founder of EasyOptOuts and the person behind the creation 404 aware of the vulnerability, does not think iCloud+ users’ emails are completely safe.
“The bug that caused Apple’s Hide My Email to disclose hidden email addresses to senders has been fixed. However, we do not believe the risk to Hide My Email users has been eliminated,” Murphy said. “Since non-malicious emails can bounce, revealing your masked email address, and mail transfer logs are often retained, we will assume that any masked email addresses linked to a Hide My Email address created before July 7, 2026 may have been exposed and could still appear in third-party logs.”
Woozad has contacted Apple for comment on the Hide My Email vulnerability. We will update this article if we receive a response.
Murphy reportedly told Apple about this hiding my email issue in June 2025. For several months, the company examined the vulnerability and claimed to fix it. After successfully finding hidden email addresses, Apple again told Murphy it would look into the problem. In case the company decided to leave the vulnerability unpatched, Murphy then contacted 404 with what he discovered.
Much of Apple’s modern public image is based on its commitment to privacy. The idea that the company was selling a privacy-focused feature that didn’t work is understandably a problem. The problem has not gone unnoticed. PCMag reports that the company now faces a proposed class action lawsuit over the Hide My Email vulnerability, seeking an injunction against Apple’s “deceptive conduct” and full recovery of all subscription fees customers paid for the feature.
