{"id":776356,"date":"2026-07-21T18:57:11","date_gmt":"2026-07-21T18:57:11","guid":{"rendered":"https:\/\/www.newsbeep.com\/us\/776356\/"},"modified":"2026-07-21T18:57:11","modified_gmt":"2026-07-21T18:57:11","slug":"apple-fixes-hide-my-email-vulnerability-after-404-media-coverage","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us\/776356\/","title":{"rendered":"Apple Fixes Hide My Email Vulnerability After 404 Media Coverage"},"content":{"rendered":"

Apple says it has fixed a vulnerability in its Hide My Email feature which let essentially anyone figure out a user\u2019s real email address which was supposed to be protected by the feature. Apple only fixed the vulnerability after 404 Media wrote about it<\/a> at the start of July, despite Apple knowing about the issue for more than a year.<\/p>\n

The news also follows the filing of a class action lawsuit<\/a> against Apple over the vulnerability.<\/p>\n

On Wednesday Apple told 404 Media it deployed a patch for the issue on July 3, which the company says has fully resolved the issue.\u00a0<\/p>\n

Hide My Email is part of Apple\u2019s paid iCloud+ product. It lets customers quickly create a new, anonymous email address they can then use to sign up to websites, services, or email people with. The generated email addresses typically contain two random words followed by a number and the @icloud.com<\/a> domain. I use it heavily so hackers may have a harder time cross-referencing my activity and accounts across data breaches, for example.\u00a0<\/p>\n

\ud83d\udca1<\/p>\n

Do you know about any other privacy issues like this? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.<\/p>\n

Tyler Murphy, co-founder of EasyOptOuts<\/a>, discovered he was able to find the real email address of Hide My Email users. At the time, Murphy said, \u201cWe don’t know the full scope of the issue, but in our limited tests with volunteers, 100% of Hide My Email addresses were exploitable.\u201d That included mine, which we tested.<\/p>\n

Murphy first reported the issue to Apple in June 2025. Over the subsequent months, Apple said it was looking into the issue and said it had fixed it; Murphy found it was still exploitable; and Apple again said it was looking into it. Murphy, thinking Apple may not fix the issue at all, then contacted 404 Media, around a year after Apple learned of the vulnerability.<\/p>\n

When 404 Media first covered the issue several weeks ago, we did not include any details on how it worked because Apple had not fixed it. Meaning, if we published more specifics, third parties might figure out how to exploit it and reveal peoples\u2019 real email addresses.<\/p>\n

Now Apple says it has been fixed, we can add that, in simple terms, it required sending a target Hide My Email user a message that got rejected as spam. \u201cWe don’t know how often hidden email addresses were leaked in email logs. For many major email hosts, the leak was triggered simply by an email being automatically rejected as spam, even if it was a legitimate message. Such emails probably didn’t make it to your inbox, so you can\u2019t review your spam folder to learn whether you were affected,\u201d Murphy and EasyOptOut co-founder Ben Weiner said in a new statement.<\/p>\n

\u201cThe bug that caused Apple’s Hide My Email to leak hidden email addresses to senders has been fixed. However, we don’t think the risk to Hide My Email users has been eliminated. Because non-malicious emails could bounce, revealing your hidden email address, and because mail transfer logs are often retained, we’d assume that any hidden email address linked to a Hide My Email address created before July 7, 2026, may have been exposed and could still be in third-party logs,\u201d they added.<\/p>\n

The class action lawsuit against Apple seeks full recovery of the subscription costs customers paid for the feature and an injunction against Apple for its \u201cdeceptive conduct,\u201d PCMag reported<\/a>.<\/p>\n

About the author<\/p>\n

Joseph is an award-winning investigative journalist focused on generating impact. His work has triggered hundreds of millions of dollars worth of fines, shut down tech companies, and much more.<\/p>\n

\"Joseph <\/p>\n","protected":false},"excerpt":{"rendered":"Apple says it has fixed a vulnerability in its Hide My Email feature which let essentially anyone figure…\n","protected":false},"author":2,"featured_media":776357,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[74],"class_list":["post-776356","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/776356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/comments?post=776356"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/776356\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media\/776357"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media?parent=776356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/categories?post=776356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/tags?post=776356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}