A particularly disturbing revelation comes to question the reliability of Hide My Email , one of the most popular privacy features offered by Apple to iCloud be users . According to new reports, a security vulnerability allows, under certain circumstances, the real email address hidden behind the temporary relay addresses created by the service to revealed
The most worrying aspect of the case is that the problem has reportedly been known to Apple since mid-2025, with no definitive solution yet. Although the company says it is investigating the issue, the latest tests show that the vulnerability still exists.
What is Hide My Email?
Hide My Email is a core feature of Apple's ecosystem and is offered to iCloud+ subscribers. The feature creates unique, random email addresses that act as intermediaries between the user and the service they sign up for.
This way, the user never reveals their real email address, while all messages are automatically forwarded to their regular account.
See also: The next Apple Watch models will probably not have Touch ID
The service is designed primarily to protect privacy, limiting spam, unwanted advertising, and the collection of personal data by websites and advertising networks.
The discovery of the vulnerability
The problem was identified by Tyler Murphy, co-founder of the company EasyOptOuts, who in June 2025 responsibly informed Apple through the vulnerability reporting program.
According to him, he provided full instructions for reproducing the problem and all the necessary technical data so that the company's engineers could confirm the vulnerability. However, more than twelve months later, the problem still exists.
Murphy did not publicly disclose the technical details of the attack, choosing to protect users until an official fix is available. However, he argued that Hide My Email users have a right to know that the anonymity the service offers may not be absolute.
Why is vulnerability considered serious?
The value of Hide My Email is based on the fact that it hides a user's real email address from third parties. However, if an attacker manages to connect the relay address to the real email, then the entire privacy.
The problem is made even more serious by the fact that there are publicly available services that link email addresses to personal information, such as names, social media accounts, or past data breaches. So even a partial disclosure can lead to the full identification of a user.
Apple is still investigating the case
The communication between the researcher and Apple lasted for several months. Initially, the company confirmed that it was looking into the issue. In March 2026, it informed Murphy that it had implemented changes to the system that, in its assessment, addressed the problem. However, new tests showed that the vulnerability remained active.
New exchanges of technical information followed, with Apple reiterating that it was continuing its checks and asking the researcher not to make the details public until the investigation was complete.
Murphy, for his part, even suggested temporarily suspending the availability of the Hide My Email feature until a definitive solution is available, in order to limit the number of users who may be exposed.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Elon Musk's SpaceX & Tesla email accounts must be handed over in lawsuit against Apple
Changes are coming to the service
In parallel with investigating the vulnerability, Apple has already announced significant changes to how the Hide My Email and Sign in with Apple.
According to a related update to developers, new email addresses created will no longer use the familiar domains icloud.com or privaterelay.appleid.com.
In the future, all new addresses will be based on the new domain private.icloud.com, which requires developers and email providers to adapt their systems in a timely manner.
Change raises new concerns
The move to the new domain also creates a new potential problem. Since all Hide My Email addresses will now be easily identifiable by the common domain private.icloud.com, websites, services, or newsletters could theoretically automatically block these addresses, requiring users to use their real email address.
See also: Apple's account change notifications send phishing emails
In this way, the service loses some of the "invisibility" that until now made it difficult for websites to recognize that it was an Apple relay address.
Privacy remains a key challenge
The case highlights a broader issue that affects all privacy services. Even the most advanced privacy mechanisms require ongoing maintenance and rapid response to vulnerabilities when they are identified.
For Apple, which has invested heavily in its image as a privacy-first company, a delay in resolving such a sensitive issue could affect user trust. Until an official security update is released, users of Hide My Email should be aware that while the service still offers a significant level of protection against spam and unwanted tracking, it is not necessarily a completely impenetrable wall of anonymity.
