Apple repairs Hide My Email vulnerability affecting user address privacy

The record

Written from the 1 report below. Nothing here is unsourced.

Apple has fixed a security flaw in its Hide My Email service that could reveal users' real email addresses when a message sent to their hidden address was rejected as spam.
The flaw was reported in June 2025, and after earlier unsuccessful patch attempts, the fix was deployed on July 3, 2026.
Hide My Email, a paid iCloud+ feature, generates random addresses that forward messages to users' inboxes to protect privacy.
The fix comes as Apple faces a class action lawsuit alleging it misled customers about the feature's privacy, and users should note that addresses linked to Hide My Email addresses created before July 7, 2026 may have been exposed in mail transfer logs.

Outcome of the class action lawsuit against Apple over Hide My Email privacy claims
Whether Apple makes further changes to Hide My Email, such as disabling the feature or notifying affected users
Publication of more technical details or additional reports of exploitation of the flaw

1 report

English national1

All filed from India

Named United States · Hide My Email · 404 Media · Apple · Ben Weiner · EasyOptOuts · Tyler Murphy

The 1 report is listed beside the record.

Answers cite the reports above, or say they can't.