Apple patches Hide My Email leak after year-long delay

A privacy feature you pay for should probably not leak the exact thing you are paying it to hide. That is the awkward story out of Cupertino this week. 404 Media reports that Apple has quietly patched a bug in Hide My Email, the iCloud+ alias service, more than a year after it was first reported.

The reporter for the flaw is Tyler Murphy, co-founder of EasyOptOuts, who disclosed the issue to Apple in June 2025. The mechanic, according to 404, was straightforward. Send a Hide My Email user a message crafted to be rejected as spam, and the real underlying address could leak back out to the sender. In tests the researcher ran with volunteers, 100 percent of Hide My Email addresses were found to be exploitable. Apple acknowledged the report about a month after receiving it and said it was investigating, then went quiet, and Murphy eventually took the story public because, in his words, 'we don't feel comfortable waiting any longer.'

The patch shipped on July 3, 2026, and Apple's line is that it 'has fully resolved the issue.' The uncomfortable part is what happened during the year in between. Murphy and his co-founder Ben Weiner point out that 'we don't know how often hidden email addresses were leaked,' and that any address created before July 7, 2026 may already have been exposed. A class action has been filed seeking subscription cost recovery and an injunction against Apple on a deceptive-conduct claim.

The honest caveat is that the reporting does not tell you what triage priority Apple originally assigned the bug, why the fix took as long as it did, or how many real addresses ended up in strangers' mail logs. Those numbers may never surface. What you can act on today is smaller and more practical. If you use Hide My Email for anything you genuinely want kept anonymous, aliases created before this month should be treated as potentially compromised, and rotating them is the cheap move. For competing alias providers, this is a rare open door to compete on disclosure hygiene rather than on features.