Apple finally fixes Hide My Email security flaw – a year after it was first discovered

Apple fixes the Hide My Email bug, which revealed anonymous addresses through rejected spam logs
Hidden emails created before July 7, 2026 may still show up in third-party logs
Users should update and consider regenerating hidden addresses to reduce the risk of ongoing exposure

A year after it was first discovered, a vulnerability in Apple’s Hide My Email feature has finally been patched — but some users are likely to remain at risk until they, too, make changes.

The Hide My Email feature is part of the paid iCloud+ offering and allows users to quickly create a new, anonymous email address – very handy for people who don’t want to share their email with different products across the web. It is also important as some companies tend to sell this information to third parties who then, unsolicited, start sending spam emails and various offers.

In June 2025, security researcher Tyler Murphy found a way to link these anonymous emails to the “real” addresses, rendering the entire service useless. He disclosed his findings to Apple, which responded with a correction. The problem remained, however, and Murphy went back and forth with Apple until he finally decided to go public.

Was it finally fixed?

Now he says that the problem had finally been solved, but there are caveats:

“We don’t know how often hidden email addresses were leaked in email logs. For many large email hosts, the leak was triggered by an email being automatically rejected as spam even though it was a legitimate message. Such emails likely didn’t reach your inbox, so you can’t go through your spam folder to find out if you were affected,” he said.

Although the bug has now been fixed, he believes the risk to Hide My Email users remains. “Because non-malicious emails could bounce and expose your hidden email address, and because email transmission logs are often preserved, we would assume that any hidden email address associated with a Hide My Email address created before July 7, 2026 may have been exposed and may still be in third-party logs.”

Apple released a working fix on July 3, 2026, urging users to update immediately.

Via 404 media