Apple Hide My Email Vulnerability Exposes Real Addresses

Apple’s "Hide My Email" feature, designed to mask user identities, contains a vulnerability that allows attackers to uncover the real email addresses behind generated aliases [1]. The flaw, which has been known to Apple for more than a year, undermines the primary privacy promise of the iCloud+ service by potentially exposing personal contact information to data brokers and bad actors [2, 4].

The security flaw

The vulnerability allows an attacker to trace a random, disposable @icloud.com address back to a user’s primary inbox [1]. Tyler Murphy, co-founder of the privacy service EasyOptOuts, first reported the issue to Apple in June 2025 [2]. Despite multiple communications, including a March 2026 update where Apple claimed the bug was resolved, the exploit remains functional [1, 4]. In controlled tests, researchers were able to link anonymous aliases to real accounts within five minutes [2].

The exposure carries significant risks, as leaked email addresses can be cross-referenced with publicly accessible people-search sites to harvest names, home addresses, and phone numbers [2, 4]. While Apple requested that the vulnerability remain undisclosed while they investigated, the lack of a fix led to the public disclosure of the flaw this week [1, 2]. Apple has not provided a definitive timeline for a patch [1].

Domain changes and future updates

Separately, Apple is transitioning its email relay infrastructure to a unified domain, moving from @icloud.com to @private.icloud.com [1, 3]. This shift, expected to roll out later this summer, will apply to future email IDs generated through both "Sign in with Apple" and "Hide My Email" [3].

While Apple states this change is intended to simplify account systems and email validation for developers, it introduces a new trade-off for users [1, 3]. The move to a standardized domain may make it easier for third-party services to identify and block signups originating from Apple’s privacy aliases [1, 2]. Existing accounts will continue to function on the older domain, and the change is primarily a backend adjustment rather than a security patch for the current vulnerability [3].

What to watch

• Official Patch Release: Monitor for a formal security update from Apple that specifically addresses the alias-linking vulnerability.
• Domain Migration: Watch for the transition to the @private.icloud.com domain, which may coincide with the release of iOS 27 in September.
• Developer Implementation: Observe how third-party websites adjust their email filtering and routing rules once the unified domain becomes the standard for new signups.

Until Apple confirms a fix, the privacy protections offered by Hide My Email may not be as robust as the company’s marketing suggests. The open question remains why a vulnerability reported over 12 months ago persists in a service marketed specifically for user anonymity [1, 2].