# Apple Hide My Email Vulnerability Exposes Real Addresses

**Published:** 2026-08-25T07:38:32.371Z  
**Topic:** Apple News  
**Sentiment:** neutral  
**Publisher:** TrendWatcher — https://www.trendwatcher.in/article/7b8bb1ec-3f6f-4e44-b48b-6bb71b41ca9f

Apple’s Hide My Email feature has a security flaw that can reveal real user addresses. The bug, known for over a year, affects iCloud+ privacy protections.

Apple’s "Hide My Email" feature, designed to mask user identities, contains a vulnerability that allows attackers to uncover the real email addresses behind generated aliases [1]. The flaw, which has been known to Apple for more than a year, undermines the primary privacy promise of the iCloud+ service by potentially exposing personal contact information to data brokers and bad actors [2, 4].

| At a glance | |
|---|---|
| Product | Apple Hide My Email |
| Vulnerability | Real address exposure |
| Discovery Date | June 2025 |
| Current Status | Unpatched |

## The security flaw
The vulnerability allows an attacker to trace a random, disposable @icloud.com address back to a user’s primary inbox [1]. Tyler Murphy, co-founder of the privacy service EasyOptOuts, first reported the issue to Apple in June 2025 [2]. Despite multiple communications, including a March 2026 update where Apple claimed the bug was resolved, the exploit remains functional [1, 4]. In controlled tests, researchers were able to link anonymous aliases to real accounts within five minutes [2].

The exposure carries significant risks, as leaked email addresses can be cross-referenced with publicly accessible people-search sites to harvest names, home addresses, and phone numbers [2, 4]. While Apple requested that the vulnerability remain undisclosed while they investigated, the lack of a fix led to the public disclosure of the flaw this week [1, 2]. Apple has not provided a definitive timeline for a patch [1].

## Domain changes and future updates
Separately, Apple is transitioning its email relay infrastructure to a unified domain, moving from @icloud.com to @private.icloud.com [1, 3]. This shift, expected to roll out later this summer, will apply to future email IDs generated through both "Sign in with Apple" and "Hide My Email" [3]. 

While Apple states this change is intended to simplify account systems and email validation for developers, it introduces a new trade-off for users [1, 3]. The move to a standardized domain may make it easier for third-party services to identify and block signups originating from Apple’s privacy aliases [1, 2]. Existing accounts will continue to function on the older domain, and the change is primarily a backend adjustment rather than a security patch for the current vulnerability [3].

## What to watch
*   **Official Patch Release:** Monitor for a formal security update from Apple that specifically addresses the alias-linking vulnerability.
*   **Domain Migration:** Watch for the transition to the @private.icloud.com domain, which may coincide with the release of iOS 27 in September.
*   **Developer Implementation:** Observe how third-party websites adjust their email filtering and routing rules once the unified domain becomes the standard for new signups.

Until Apple confirms a fix, the privacy protections offered by Hide My Email may not be as robust as the company’s marketing suggests. The open question remains why a vulnerability reported over 12 months ago persists in a service marketed specifically for user anonymity [1, 2].

## Sources
1. Cult of Mac — [Apple’s Hide My Email has been leaking real addresses for a year](https://www.cultofmac.com/news/apple-icloud-hide-my-email-exploit)
2. Gizmodo — [Apple’s ‘Hide My Email’ Feature May Reveal Users’ Real Addresses](https://gizmodo.com/apples-hide-my-email-feature-may-reveal-users-real-addresses-2000780291)
3. Cult of Mac — [Apple’s next privacy change is happening behind the scenes](https://www.cultofmac.com/news/apples-next-privacy-change-happening-behind-the-scenes)
4. Lifehacker — [Apple's 'Hide My Email' Reportedly Exposes Your Real Email Address](https://lifehacker.com/tech/apples-hide-my-email-reportedly-exposes-your-real-email-address)

---
Cite as: TrendWatcher, "Apple Hide My Email Vulnerability Exposes Real Addresses", https://www.trendwatcher.in/article/7b8bb1ec-3f6f-4e44-b48b-6bb71b41ca9f