Apple’s Hide My Email feature, designed to protect users’ privacy by generating random email addresses, has been under scrutiny due to a vulnerability that exposes users’ real email addresses. Despite Apple’s assertion that the issue was resolved on July 3, 2026, recent tests indicate that the flaw remains unpatched.
Hide My Email allows users to create unique, random email addresses that forward messages to their personal inboxes, thereby concealing their actual email addresses from recipients. This service is particularly useful for signing up for online services without revealing personal information, aiming to reduce spam and enhance privacy.
In June 2025, security researcher Tyler Murphy discovered a vulnerability in Hide My Email that could potentially reveal users’ real email addresses. Murphy promptly reported the issue to Apple, providing detailed instructions for replication. However, over a year later, the problem persisted, raising concerns about the effectiveness of Apple’s response to security vulnerabilities.
Apple initially acknowledged the issue and, in March 2026, claimed to have addressed it through a system change. Despite this, Murphy’s subsequent testing revealed that the vulnerability was still exploitable. Further communications with Apple led to assurances that the problem was under investigation and would be resolved in an upcoming security update. By the end of May 2026, Apple indicated that a fix was expected in the coming weeks.
On July 3, 2026, Apple informed 404 Media that it had deployed a patch to fully resolve the vulnerability. However, testing conducted two weeks later demonstrated that the flaw remained active, contradicting Apple’s claims. This discrepancy has raised questions about the company’s commitment to promptly and effectively addressing security issues.
In addition to the ongoing vulnerability, Apple announced changes to the email domains used for Hide My Email and Sign in with Apple. The new domains, transitioning from icloud.com to private.icloud.com, are intended to enhance privacy. However, this change could lead to unintended consequences, such as websites or newsletters blocking emails from the new domain, thereby limiting the functionality of Hide My Email.
Furthermore, a class-action lawsuit was filed against Apple on July 15, 2026, alleging false advertising and breach of contract related to the Hide My Email service. The lawsuit claims that Apple sold customers a privacy feature that failed to deliver on its promises, seeking damages and an order for Apple to fix the service or disclose its limitations.
The persistence of the Hide My Email vulnerability, despite multiple assurances from Apple, underscores the challenges tech companies face in maintaining user privacy and trust. As digital privacy becomes increasingly important, users expect prompt and effective responses to security flaws. Apple’s handling of this issue highlights the need for transparency and accountability in addressing vulnerabilities that impact user data.
