Apple Releases Fixes for Hide My Email Flaw that Exposes Users’ Real Email Addresses

Apple patched a vulnerability in its iCloud+ "Hide My Email" feature that could expose users' real email addresses from anonymized aliases by exploiting interactions with spam filters and mail transfer logs. Researcher Tyler Murphy reported the issue in June 2025 and Apple fixed it on July 3, 2026; however, aliases created before the patch may have been leaked and retained in third-party systems, and a class-action lawsuit has been filed.