Apple's 'Hide My Email' Vulnerability Exposes User Email Addresses

Techcrunch

Apple's 'Hide My Email' Vulnerability Exposes User Email Addresses

First seen 1 Jul 2026, 15:46 UTC • •69.0

Article Content

1 / 42

Browse articles

ThreatCluster •July 2, 2026 at 14:06 UTC

•A vulnerability in Apple's 'Hide My Email' feature exposes real email addresses.
•The flaw was reported over a year ago but remains unpatched as of July 2026.
•Apple plans to change the alias domain, potentially making the feature less effective.

A significant vulnerability in Apple's 'Hide My Email' feature allows attackers to uncover users' real email addresses behind generated aliases. Discovered by Tyler Murphy of EasyOptOuts, the flaw was reported to Apple in June 2025 but remains unpatched as of July 2026. Independent testing confirmed that 100% of tested aliases were exploitable, raising serious privacy concerns for users relying on this feature. Apple acknowledged the issue and claimed to have addressed it in March 2026, but subsequent tests revealed that the vulnerability persists. Additionally, Apple plans to change the domain of these aliases from @icloud.com to @private.icloud.com, which may further hinder the feature's effectiveness. Users are advised to consider alternative privacy options while Apple investigates the issue.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 100d ago How this analysis works

Timeline

2025-06-01

Vulnerability reported to Apple

Tyler Murphy reported the flaw in 'Hide My Email' to Apple, providing replication instructions.

2026-03-01

Apple claims to have addressed the issue

Apple announced that it had patched the vulnerability in a system update, but tests showed it still existed.

2026-05-01

Ongoing investigation confirmed

Apple informed Murphy that the investigation into the vulnerability was still ongoing.

2026-06-16

Apple announces domain change

Apple plans to change the domain of 'Hide My Email' addresses to @private.icloud.com, affecting usability.

2026-07-01

Public disclosure of vulnerability

The ongoing vulnerability in 'Hide My Email' is publicly disclosed, revealing the risk to users.

Cybersecuritynews

More articles in this cluster (41)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Data Breach

Organization (2)

404 Media
Apple

Weakness (1)

CWE-200 - Exposure of Sensitive Information

Affected Platform (2)

Hide My Email
ICloud

Relationships

Data Breach targets Hide My Email
Data Breach targets ICloud
Data Breach related to 404 Media
Data Breach related to Apple
Data Breach related to CWE-200 - Exposure of Sensitive Information

Following this threat?

Track 404 Media in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…