Apple Fixes Hide My Email Vulnerability After 404 Media Coverage

Account

Log in

Subscribe

Navigation

Home

About

RSS

Support/FAQ

Podcast

FOIA Forum Archive

Merch

Advertise

Privacy

Contact Us/Tips

Follow us

Twitter<br>Bluesky<br>Mastodon<br>Instagram<br>TikTok<br>Facebook<br>RSS

Advertisement

&bull;

Go ad free

Impact<br>Apple Fixes Hide My Email Vulnerability After 404 Media Coverage

Joseph Cox

Jul 21, 2026<br>at 11:20 AM

For a year, Apple knew that an issue in its Hide My Email feature was exposing customers’ real email addresses. Apple only fixed the issue after 404 Media covered it.

Photo by Chris Nagahama on Unsplash

Apple says it has fixed a vulnerability in its Hide My Email feature which let essentially anyone figure out a user’s real email address which was supposed to be protected by the feature. Apple only fixed the vulnerability after 404 Media wrote about it at the start of July, despite Apple knowing about the issue for more than a year.<br>The news also follows the filing of a class action lawsuit against Apple over the vulnerability.<br>On Wednesday Apple told 404 Media it deployed a patch for the issue on July 3, which the company says has fully resolved the issue.<br>Hide My Email is part of Apple’s paid iCloud+ product. It lets customers quickly create a new, anonymous email address they can then use to sign up to websites, services, or email people with. The generated email addresses typically contain two random words followed by a number and the @icloud.com domain. I use it heavily so hackers may have a harder time cross-referencing my activity and accounts across data breaches, for example.<br>💡<br>Do you know about any other privacy issues like this? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.

Tyler Murphy, co-founder of EasyOptOuts, discovered he was able to find the real email address of Hide My Email users. At the time, Murphy said, “We don't know the full scope of the issue, but in our limited tests with volunteers, 100% of Hide My Email addresses were exploitable.” That included mine, which we tested.<br>Murphy first reported the issue to Apple in June 2025. Over the subsequent months, Apple said it was looking into the issue and said it had fixed it; Murphy found it was still exploitable; and Apple again said it was looking into it. Murphy, thinking Apple may not fix the issue at all, then contacted 404 Media, around a year after Apple learned of the vulnerability.<br>When 404 Media first covered the issue several weeks ago, we did not include any details on how it worked because Apple had not fixed it. Meaning, if we published more specifics, third parties might figure out how to exploit it and reveal peoples’ real email addresses.

Now Apple says it has been fixed, we can add that, in simple terms, it required sending a target Hide My Email user a message that got rejected as spam. “We don't know how often hidden email addresses were leaked in email logs. For many major email hosts, the leak was triggered simply by an email being automatically rejected as spam, even if it was a legitimate message. Such emails probably didn't make it to your inbox, so you can’t review your spam folder to learn whether you were affected,” Murphy and EasyOptOut co-founder Ben Weiner said in a new statement.<br>“The bug that caused Apple's Hide My Email to leak hidden email addresses to senders has been fixed. However, we don't think the risk to Hide My Email users has been eliminated. Because non-malicious emails could bounce, revealing your hidden email address, and because mail transfer logs are often retained, we'd assume that any hidden email address linked to a Hide My Email address created before July 7, 2026, may have been exposed and could still be in third-party logs,” they added.<br>The class action lawsuit against Apple seeks full recovery of the subscription costs customers paid for the feature and an injunction against Apple for its “deceptive conduct,” PCMag reported.

About the author

Joseph is an award-winning investigative journalist focused on generating impact. His work has triggered hundreds of millions of dollars worth of fines, shut down tech companies, and much more.

More from Joseph Cox

More like this

Immigrant Rights Lawyers File Lawsuit Over Palantir’s ELITE

Just Futures Law is seeking a wealth of documents related to the tech Palantir provides to ICE.

Joseph Cox

Jun 4, 2026

Apple Fixes Bug That Let FBI Extract Deleted Signal Messages After 404 Media Coverage

The move comes directly in response to 404 Media’s coverage about how the FBI was able to recover incoming Signal messages from an iPhone because the messages were saved in the device’s notification storage.

Joseph Cox

Apr 29, 2026

Thomson Reuters Shareholders Demand Investigation into ICE Contracts

The shareholders explicitly cited multiple 404 Media investigations, including one that showed Thomson Reuters' CLEAR is...