Apple Patches Year-Old Hide My Email Bug That Leaked Real Addresses
A flaw in Apple's email-cloaking feature let real addresses appear in mail logs. The fix took over a year to ship.
Key points
- Apple fixed a flaw in Hide My Email, its service that hides a user's real email address behind a random alias, on July 3, 2026.
- The bug let real email addresses appear in mail server logs, defeating the whole point of the feature.
- Tyler Murphy, co-founder of the data-removal firm EasyOptOuts, reported the issue to Apple over a year before it was patched.
- The problem was first reported by 404 Media on Tuesday.
- No public evidence yet that anyone abused the flaw to unmask users at scale.
Apple has quietly closed a hole in Hide My Email, the privacy feature that gives users a random throwaway address so they never have to hand over their real one.
The flaw did the opposite of what the feature promises. Under certain conditions, a user's true email address ended up visible in mail server logs. Companies and services receiving those messages could see who the person really was.
Apple shipped the fix on July 3, 2026. Tyler Murphy, co-founder of EasyOptOuts, a service that removes personal data from broker sites, had flagged the problem to Apple more than a year earlier. 404 Media reported the delay first.
What is Hide My Email supposed to do?
It's meant to keep your real email address secret. When you sign up for a newsletter or a shopping site, Apple gives you a random alias like fuzzy.otter.4821@icloud.com. Mail sent to that alias is forwarded to your real inbox; the sender never sees your actual address.
That matters for two reasons. It cuts spam, because you can burn any alias that starts getting abused. It also stops data brokers from linking your email to the rest of your online life.
The bug undermined both benefits. If your real address leaked into a company's mail logs, anyone with access, whether staff, an outside contractor or an attacker who broke in, could tie the alias back to you.
How did the leak happen?
Murphy found that the way Apple's relay servers handled certain message headers, the technical labels attached to every email, caused the underlying iCloud address to be written into logs on the receiving side. It wasn't a flashy remote exploit. A plumbing mistake in a privacy product, which is arguably worse.
Apple hasn't published a detailed advisory or a CVE identifier (a standardised public vulnerability record) for the issue. That's a fair criticism when the feature's entire marketing pitch is privacy. The company confirmed the fix is live for all users. Nothing on the user side needs updating, and existing aliases keep working.
Should ordinary users do anything?
Probably not, but a quick check is worth your time. If you've used Hide My Email to sign up for services you'd rather not link to your real Apple ID, watch whether those senders start hitting your primary inbox directly. That would suggest your real address was captured before the patch landed.
You can revoke and regenerate aliases from Settings on iPhone or iPad, or in System Settings on a Mac, under your Apple Account and then iCloud. Ten seconds per alias.
The wider lesson is familiar. Privacy features are software, and software has bugs. A relay service is only as private as its worst logging path. Murphy's report sitting unpatched for over a year isn't a great look for Apple's vulnerability response, especially from the company that runs one of the better-funded bug bounty programs in the industry. We covered Apple's security posture in a July 13 story on CrashStealer, malware that bypassed Apple's own notarisation checks, and the pattern is worth watching: the platform's reputation for privacy keeps running ahead of its execution.
For now, the hole is closed. Whether anyone was quietly harvesting unmasked addresses from mail logs during those twelve-plus months is a question Apple hasn't answered.
