TL;DR
A vulnerability in Apple’s ‘Hide My Email’ feature allows bad actors to discover users’ real email addresses via publicly accessible search sites. Apple has known about the issue since mid-2025 and has been investigating, but it remains unpatched as of July 2026. This flaw threatens user privacy and the effectiveness of the feature.
Apple’s ‘Hide My Email’ feature has a security vulnerability that can allow bad actors to uncover users’ actual email addresses. The flaw, reported by 404 Media, has been known to Apple since June 2025 and remains unpatched as of July 2026. This development raises concerns over user privacy and the security of Apple’s privacy tools.
According to reports from 404 Media, a security flaw exists in Apple’s ‘Hide My Email’ feature, which enables users to generate aliases that forward messages to their real email addresses without revealing them. The vulnerability allows malicious actors to use publicly accessible people-search sites to identify the actual email behind an alias. Tests by researchers showed that within minutes, they could retrieve real email addresses from aliases created with the feature. Apple has acknowledged the issue and confirmed it has been investigating since mid-2025, but as of July 2026, a fix has not yet been deployed.
Experts, including Tyler Murphy of EasyOptOuts, state that the exploit appears to be effective on multiple aliases tested. Murphy noted that Apple was informed of the vulnerability over a year ago, and while the company initially responded with an investigation, no patch has been released publicly. Apple has continued to confirm ongoing investigations, but users remain at risk.
Potential Privacy Risks for Apple Users
This flaw undermines the core purpose of ‘Hide My Email,’ which is to protect user identities during online sign-ups. If malicious actors can easily discover real email addresses, users’ privacy is compromised, increasing risks of spam, phishing, and targeted attacks. The issue also raises questions about Apple’s ability to secure its privacy features and the impact of ongoing investigations on user trust.
Background and Past Concerns About ‘Hide My Email’
‘Hide My Email’ was introduced as part of Apple’s broader privacy initiatives, allowing users to create unique aliases for online accounts. This feature is widely used by privacy-conscious individuals to prevent data leaks from third-party services. In recent months, reports emerged that Apple planned to change the alias domain from @icloud.com to @private.icloud.com, which could make aliases more identifiable and reduce their effectiveness. The current vulnerability adds to concerns about the feature’s robustness and future modifications.
While Apple has generally been praised for its privacy protections, this flaw highlights that even well-designed features can have security gaps. The company has acknowledged the issue and is reportedly working on a fix, but details remain undisclosed.
“Almost anyone can use publicly accessible search sites to discover the real email behind a ‘Hide My Email’ alias.”
— an anonymous researcher
Extent of the Vulnerability and Future Fixes
It is not yet clear how widespread the vulnerability is across all users or whether Apple has implemented any interim measures. The timeline for a permanent fix remains uncertain, and it is unknown if future changes to alias domains will affect the exploit’s effectiveness.
Expected Actions and User Guidance Moving Forward
Apple is expected to continue investigating the flaw, with a potential patch forthcoming. Users are advised to remain cautious, avoid sharing aliases publicly, and stay updated on official security advisories. Researchers and security experts will monitor developments to confirm when a fix is deployed and assess the vulnerability’s impact.
Key Questions
Can my real email be discovered through ‘Hide My Email’?
Yes, according to recent reports, malicious actors can use publicly accessible search sites to identify the real email address behind a ‘Hide My Email’ alias.
Has Apple acknowledged this vulnerability?
Yes, Apple has known about the issue since June 2025 and confirmed ongoing investigations, but a fix has not yet been publicly released as of July 2026.
What should I do to protect my privacy now?
Users should avoid publicly sharing their ‘Hide My Email’ aliases and stay informed about updates from Apple regarding security patches.
Will Apple change the alias domain to make it more identifiable?
Reports suggest Apple plans to change the domain from @icloud.com to @private.icloud.com, which could make aliases more recognizable and potentially reduce their privacy benefits.
When will the vulnerability be fixed?
There is no confirmed timeline for a fix, but Apple has indicated it is actively working on a solution. Users should watch for official updates.
Source: Lifehacker
