Back Cybernews Apple “Hide My Email” leaks email addresses, researcher claims
Apple’s privacy-related feature, “Hide My Email,” isn’t working as intended. It is susceptible to a vulnerability that allows users to see the actual user's email, according to a security researcher
What makes it even more alarming is that the problem appears to have persisted for more than a year after it was first noticed.
“Hide My Email” generates unique email addresses to protect users’ actual email addresses.
The vulnerability was discovered and reported to Apple by Tyler Murphy, a co-founder of EasyOptOuts, who told 404 Media that the company hadn’t fixed the issue and “we don’t feel comfortable waiting any longer.”
404 Media said it verified the vulnerability, but was not revealing the exact details because it could still be reported at the time of reporting on July 1st.
“Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses,” Murphy told the website.
The researcher first contacted Apple this problem in June, 2025, and the company shared that the issue is under review, according to the report.
In March of 2026, Apple announced an update, which said it “addressed the reported issue in a recent system change.”
However, Murphy said that the vulnerability persisted. The company then investigated it until May, also asking the researcher “to not [disclose] this information until [...] investigation is complete.”
After the company announced that the changes would be introduced in a future security update, Murphy contacted the news outlet the issue with the feature.
It has previously been reported that “Hide My Email” and “Sign in with Apple” email addresses will be unified under a new, separate subdomain, @ private.icloud.com , instead of @icloud.com and @privaterelay.appleid.com.
However, this decision could render them essentially useless, as some services might refuse to accept these emails.
Cybernews has contacted Apple for additional .
Unlock more exclusive Cybernews content on YouTube.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
