Apple Hide My Email flaw still exposes real addresses

A significant vulnerability in Apple's Hide My Email service, a core privacy feature for iCloud subscribers, can allow attackers to uncover a user's real email address, according to security researchers. The flaw, first reported to Apple in June 2025, remains unpatched as of this week, undermining the tool's primary function of protecting user anonymity.

The issue was discovered and reported by Tyler Murphy, co-founder of the online privacy company EasyOptOuts. Independent verification this week confirmed the exploit is still active. In a demonstration, a newly generated Hide My Email address was provided to Murphy, who returned the associated real Apple ID email within minutes. Murphy stated that in limited testing, the vulnerability worked on every Hide My Email address attempted.

Hide My Email allows users to create unique, anonymous forwarding addresses, typically ending in domains like icloud.com, when signing up for websites or services. The feature is designed to shield a user's personal email from spam, data breaches, and unwanted tracking. However, this flaw enables the linking of these anonymous aliases back to the user's actual Apple account email.