Apple Fixes Hide My Email Security Flaw
Privacy issue resolved for iCloud+ users.
1Vulnerability Discovery
Tyler Murphy from EasyOptOuts discovered a security flaw in Hide My Email feature in June 2025. The vulnerability exposed primary email addresses in spam email logs. Murphy reported findings to Apple, but the issue remained unresolved for a year.
2Media's Role
404 Media brought the issue to light in July 2026, prompting Apple to act. The company released a patch days after the report. Initially, media didn't disclose exploit details to prevent misuse while the vulnerability was active.
3Technical Details
The flaw revealed real email addresses in bounce-back logs when emails were rejected. Though low-tech, this seriously compromised user privacy. The issue stemmed from improper email header handling in the anonymization process.
4Affected Users
All Hide My Email addresses created before July 7, 2026 were potentially exposed. Murphy warned these addresses might remain in third-party logs. Users' privacy expectations were violated during this period.
5Legal Action
While awaiting the fix, iCloud+ users filed a class-action lawsuit against Apple. Plaintiffs claim they paid for a feature that didn't deliver promised privacy protections, seeking compensation for damages incurred.
6Privacy Imperative
This incident underscores the critical importance of privacy features in digital services. Protecting user data must be companies' top priority. While Apple's eventual response was swift, the initial delay raised concerns about accountability.
Original article: Macworld — Apple'ın Hide My Email Güvenlik Açığı Kapatıldı