Observed Signal · Jul 1, 2026 · Security Vulnerability · Source: techcrunch · Impact: 4/5 · Sentiment: Negative
Bug in Apple’s Hide My Email Exposes Real Addresses
New research reported by 404 Media and summarized by TechCrunch claims a vulnerability in Apple’s Hide My Email feature can reveal users’ real email addresses. Researcher Tyler Murphy, co‑founder of EasyOptOuts, says he informed Apple more than a year ago and that 404 Media tested and verified the issue; in limited volunteer tests Murphy reported 100% of Hide My Email addresses were exploitable. Details of the vulnerability have been withheld from public disclosure to avoid abuse. Murphy warned that people‑search and data broker sites can link exposed emails to additional personal information, increasing privacy risk. TechCrunch contacted Apple for comment. The report follows prior scrutiny of Apple privacy features in 2022 and 2023 for other perceived privacy failures.
A reported security/privacy vulnerability in an Apple privacy feature (major platform) can undermine user trust, affect identity/privacy practices across ecosystems, and invite regulatory or operational responses from advertisers and platforms.
Track Apple Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Researcher Tyler Murphy reported a bug in Apple’s Hide My Email that can unmask users' real email addresses.
- The vulnerability was reported by 404 Media, which says it tested and verified the issue.
- Murphy says he warned Apple about the problem over a year ago.
- Murphy told 404 Media that in limited volunteer tests, 100% of Hide My Email addresses were exploitable.
- Murphy is co‑founder of EasyOptOuts, a paid data‑removal service; he warned exposed emails can be linked via people‑search sites to other personal details.
Connected Companies & Entities
3 Entities mapped“Apple’s Hide My Email feature is a convenient privacy tool that uses disposable addresses to hide a user’s true email for the sake of online...”
“The bug was reported by 404 Media, which says that it has tested and verified that the vulnerability exists....”
“TechCrunch reached out to Apple for more information and will update this story if it responds....”
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Apple 'Hide My Email' Bug Reveals Real Addresses
A security researcher has reported a vulnerability in Apple’s 'Hide My Email' feature (part of iCloud+) that can reveal users’ actual email addresses behind one-time, randomly generated forwarding addresses. According to 404 Media, researcher Tyler Murphy of the data-deletion service Easyoptouts discovered the bug in June 2025 and notified Apple, but the company has not fixed the issue for about a year. 404 Media says it was able to reproduce the disclosure using the exploit supplied by Murphy. Both Murphy and 404 Media withheld technical details to avoid enabling abuse; Apple previously asked the researcher not to publish exploit details. The flaw raises privacy risks, including the ability to link masked addresses to personal data on public people-search sites.
Apple Shared Hide My Email Identities With Law Enforcement
TechCrunch reports that Apple provided real identities and account records to federal law enforcement for at least two customers who used its Hide My Email feature. Court documents show the FBI obtained the account holder’s full name, email address and records for 134 anonymized addresses in an investigation related to an allegedly threatening email; Homeland Security Investigations received similar data in a separate identity-fraud probe. Hide My Email (part of iCloud+) generates anonymized forwarding addresses, and Apple says it does not read forwarded messages, but the company retains account metadata and unencrypted content that can be turned over to authorities. The story highlights the limits of email-based privacy protections and broader implications for encrypted messaging and user trust.
Apple reverses Hide My Email domain change
Apple has reversed a planned change to its Hide My Email feature that would have moved autogenerated addresses to the @private.icloud.com domain. The company confirmed on August 24–25, 2026 that Hide My Email addresses will remain on @icloud.com after user criticism that the proposed domain change would make disposable addresses easier for sites to reject. Daring Fireball reported internal Apple objections to the switch. Earlier reporting from 404 Media documented a Hide My Email bug that leaked users’ real addresses; Apple fixed that bug after being alerted more than a year earlier.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.