Apple finally patches Hide My Email flaw after one year
Users' real email addresses were exposed for a full year due to the vulnerability.
1How the flaw was discovered
Apple's Hide My Email feature generated random addresses to mask users' real emails. However, when emails were marked as spam or bounced, the system leaked the actual address. This created a security vulnerability that went unnoticed by most users.
2Duration of the issue
Security researcher Tyler Murphy first reported the problem in June 2025. Apple's temporary fix failed, and the vulnerability persisted until July 2026. The company only released a permanent patch after the issue became public knowledge.
3Impact on users
Email aliases created before the fix may have been exposed in third-party server logs. Particularly, addresses created before July 2026 remain at risk. Apple confirmed it cannot remove these leaked records from external systems.
4Legal consequences
Apple now faces a class-action lawsuit over the Hide My Email flaw. Plaintiffs allege the company failed to deliver promised privacy protections. This raises questions about Apple's privacy commitments and accountability.
5Apple's response
The company claims the vulnerability is fully patched and future issues are prevented. However, concerns remain about older aliases. Apple also announced plans to merge Hide My Email with Sign In with Apple infrastructure later this year.
6User recommendations
Hide My Email users should remain cautious. Aliases created before July 2026 may be less anonymous, especially for senders whose emails bounced. Creating new aliases is recommended for maximum privacy protection moving forward.
Original article: Cult of Mac — Apple, Hide My Email açığını bir yıl sonra kapattı