A major vulnerability has been discovered in one of the core privacy features that Apple offers its customers. And according to the cybersecurity researchers who discovered the exploit, this issue appears to have been ongoing for more than a year.
Apple’s “Hide My Email” is a privacy feature that obscures a user’s email address by generating a unique iCloud email address, which then forwards emails to the user’s main email address. The feature allows users to receive emails without revealing their personal email address.
According to a new report from 404 Media, a vulnerability allows anyone to discover the email address behind the “Hide My Email” address Apple creates.
The vulnerability, which the outlet isn’t revealing because it is still exploitable, was discovered by online privacy company EasyOptOuts. 404 Media has also independently confirmed that the exploit exists.
Typically, before an exploit is revealed to the public, researchers report their discovery to the company and give the company a reasonable amount of time to fix the vulnerability. According to EasyOptOut, they informed Apple more than a year ago, yet the vulnerability still exists.
Mashable Light Speed
”Apple Hide My Email is leaking email addresses that are supposed to be hidden,” said EasyOptOuts cofounder Tyler Murphy. “We reported the issue and replication instructions to Apple over a year ago. We don’t know why it hasn’t been fixed, but we don’t feel comfortable waiting any longer. Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses.”
Murphy told 404 Media that the issue was reported to Apple in June 2025. The company said it “addresses” the issue in March 2026. However, Murphy discovered the vulnerability still existed.
“We don’t know the full scope of the issue, but in our limited tests with volunteers, 100% of Hide My Email addresses were exploitable,” Murphy told 404 Media.
Apple last told Murphy that it was “still investigating this issue” in May.
Hide My Email is a feature available to paying iCloud+ subscribers. It has several use cases. For example, users may use a Hide My Email-generated email address to sign up for mailing lists so they don’t get spammed at their real email address. Or they may sign up for a website using a Hide My Email address if they don’t want their main address linked to that site.
In June, TechCrunch reported that Apple was planning to make changes to the Hide My Email feature that could render it useless for users. Currently, the generated anonymous Hide My Email address utilizes the “iCloud.com” domain, which is also used by people who use their iCloud.com username as their main email address. In a recent note to developers, Apple announced it would move Hide My Email addresses to the “private.icloud.com” domain. This domain would be reserved for Hide My Email addresses, meaning that platforms and services could block email addresses with that domain name outright.
iCloud+ users who rely on Hide My Email may want to explore other email privacy options as Apple sorts out the feature.
