Apple Patches Hide My Email Flaw That Exposed Real Email Addresses

Apple patched a vulnerability in Hide My Email that could reveal users’ real email addresses when messages sent to an alias were rejected as spam, exposing the underlying address in email logs. Researcher Tyler Murphy of EasyOptOut reported the issue to Apple in June 2025, but reports say the company did not fully remediate it until July 3, 2026, after public coverage highlighted that the flaw remained exploitable despite an earlier claim that it had been fixed.

Limited testing by the researcher indicated that all tested Hide My Email aliases were vulnerable, and users who created addresses before July 7, 2026 may still face exposure through retained third-party mail logs generated before the patch. The incident has triggered a proposed class action lawsuit accusing Apple of false advertising and consumer protection violations, with plaintiffs seeking reimbursement of subscription costs and an injunction related to the service.