A security researcher has revealed a serious vulnerability in Apple's Hide My Email feature, which allows attackers to uncover the real email address associated with the user's account, despite the feature being specifically designed to hide it using temporary email addresses to protect privacy.

According to a report by 404 Media, the outlet confirmed the existence of the vulnerability in practice, following tests conducted by security researcher Tyler Murphy. The site stated that all email addresses tested were detectable with a 100% success rate.

Murphy said he reported the problem to Apple in June of last year, including instructions to reproduce it, but the company has not fixed it yet.

He added that Apple told him in March that it had addressed the vulnerability, but he discovered it still persisted, before Apple asked him not to disclose it until an official fix was released.

According to Murphy, Apple promised to address the issue in June, but with the vulnerability still unpatched, he decided to disclose it to protect users, while refraining from publishing technical details or exploitation methods to prevent misuse.

The researcher noted that people-search sites and data brokers could use the real email to link it to other personal information, potentially exposing users who rely on the Hide My Email feature to protect their identities to privacy and security risks. 404 Media did not reveal the technical details of the vulnerability, confirming it remains exploitable.

This incident comes at a time when Apple continues to market itself as one of the most privacy-conscious companies, but it is not the first time it has faced criticism in this area.

In 2022, the company faced a lawsuit after reports indicated that some iPhone apps continued sending analytics data even when the share analytics option was disabled. Also, in 2023, researchers discovered a flaw in another feature designed to hide the device's MAC address, which in some cases revealed the real address.

In a related development, Apple recently announced it will use the private.icloud.com domain for email addresses used in the Hide My Email feature in the future, a move that raised concerns among some users about the possibility of this domain being blocked by certain companies, which could limit the feature's effectiveness in protecting privacy.

Tags

Hide My Mail Apple

2 July 2026 Last updated: 2 July 2026

One minute

Follow us