Back Feeds.4Sysops

Apple Hide My Email vulnerability exposes real user addresses

Feeds.4Sysops •IT News • July 1, 2026

A critical vulnerability in Apple’s Hide My Email service reportedly allows attackers to uncover the real email addresses associated with generated aliases. Discovered by security researcher Tyler Murphy, the flaw was responsibly reported to Apple over a year ago but remains unpatched despite multiple follow-ups. Independent testing by 404 Media successfully verified the exploit, confirming that a hidden iCloud address could be linked to a user's primary identity in minutes. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apple's 'Hide My Email' Vulnerability Exposes User Email Addresses A significant vulnerability in Apple's 'Hide My Email' feature allows attackers to uncover users' real email addresses behind generated aliases. Discovered by Tyler Murphy of EasyOptOuts, the flaw was reported to Apple in June 2025 but remains unpatched as of July 2026. Independent testing confirmed that 100% of tested aliases were exploitable, raising serious privacy concerns for users relying on this feature. Apple acknowledged the issue and claimed to have addressed it in March 2026, but subsequent tests revealed that the vulnerability persists. Additionally, Apple plans to change the domain of these aliases from @icloud.com to @private.icloud.com, which may further hinder the feature's effectiveness. Users are advised to consider alternative privacy options while Apple investigates the issue. 33 sources 69

Extracted Entities

Apple Hide My Email vulnerability exposes real user addresses

The full story

Extracted Entities

Attack Types (1)

Companies (2)

CWE Weaknesses (1)

Platforms (1)