Apple has released a patch on July 3 to fix a vulnerability in its Hide My Email feature that exposed users' real email addresses. The flaw was initially reported to Apple in June 2025 but remained unaddressed until 404 Media publicized the bug in early July.

Tyler Murphy, co-founder of EasyOptOuts, first alerted Apple about the issue. Despite assurances that it was being investigated and later claimed to be fixed in March 2026, the vulnerability persisted. Murphy subsequently contacted 404 Media to bring public attention to the problem.

Hide My Email, a paid iCloud+ feature, allows users to generate anonymous email addresses. The vulnerability could be exploited when a message sent to a Hide My Email address was rejected as spam, revealing the user's actual email in logs. While the bug is now patched, Murphy and Ben Weiner noted that email logs predating the fix may still contain exposed addresses, potentially affecting users who created Hide My Email addresses before July 7, 2026.

Apple is now facing a class-action lawsuit over the flaw, alleging violations of false advertising and consumer protection laws.