Hide My Email: A Privacy Shield That Now Has Holes
Apple’s Hide My Email feature is an email privacy tool for iCloud+ subscribers that generates random relay addresses so users can sign up for apps and websites without revealing their real inboxes, but a current bug can expose the very email addresses it was designed to protect.
The key takeaway is blunt: if you rely on Hide My Email for anonymity, your real address may be leaking. A researcher, Tyler Murphy, discovered that a bug in the feature lets hackers uncover your actual email address—the exact data Hide My Email promises to hide. He reported the issue in June 2025, and tests show the leak has persisted for close to a year. This is not a theoretical concern; it is an email privacy vulnerability with direct consequences for spam, phishing, and long‑term tracking across services.
Worse, the problem sits inside Apple’s own privacy-branded ecosystem. Hide My Email is bundled with an iCloud+ subscription, which starts at $0.99 (about AED 3.65) a month, and it is marketed as a premium privacy benefit. When the privacy add‑on becomes an Apple privacy bug, the trust hit is bigger than the technical flaw itself.
What the Apple Hide My Email Leak Looks Like in Practice
In normal operation, Hide My Email hands a website or app a dummy address—currently a random word‑text combo using the @icloud.com domain—that forwards to your real inbox. On paper, this breaks the direct link between your identity and your sign‑ups. In practice, Murphy’s testing showed that the feature was still leaking real email IDs even after Apple claimed to have fixed the bug.
According to one report, “the service is leaking real email addresses, and has been for close to a year.” That means people who thought they were using a disposable alias could have had their true address exposed to the services they were trying to keep at arm’s length. 404 Media generated fresh Hide My Email addresses and had them checked by Murphy, and those new aliases also leaked the underlying email addresses they were supposed to hide.
The result is classic email address exposure: your main inbox becomes reachable and correlatable, enabling spam campaigns, targeted phishing, and cross‑site profiling. An email privacy vulnerability in a shield feature is worse than not having the shield at all, because it lulls users into over‑sharing under a false sense of safety.
Apple’s Fix Timeline Raises Tough Questions About Its Privacy Story
Murphy reported the Apple Hide My Email leak in June 2025. Apple responded the following month and later confirmed the bug was fixed in March 2026. Yet when Murphy ran tests again, the feature was still leaking real email IDs. As of May, Apple is still investigating the Hide My Email bug and has even asked Murphy not to disclose details to reduce risk to customers, with a new patch “expected in the coming weeks.”
Here is the uncomfortable part: Hide My Email is not a lab experiment; it is a shipping feature marketed as a premium privacy safeguard alongside iCloud+. The incident highlights a widening gap between Apple’s privacy marketing and how those promises hold up in production apps. When a company says “Privacy. That’s our focus,” users reasonably assume that a flagship email protection feature has been stress‑tested before it is bundled into a paid subscription.
Apple has announced that later this summer both Sign in with Apple and Hide My Email will use the private.icloud.com domain, which may be part of a longer‑term architecture fix. But domain changes do not erase the fact that this Apple privacy bug survived an initial “fix” and months of active use. For a brand that trades on trust, that is a serious credibility debt.
If You Use Hide My Email, Treat It as Broken for Now
Until Apple ships and verifies a working patch, users need to treat Hide My Email as compromised. Murphy even suggested pausing the feature until a fix is ready; Apple declined, saying a patch was expected within weeks. That leaves the burden on you to work around an ongoing email privacy vulnerability.
- Avoid creating new Hide My Email addresses for sensitive services such as banks, health portals, or anything tied to your legal identity.
- Where possible, switch critical accounts away from Hide My Email aliases to either your main address or a different alias system you control.
- Use a privacy‑friendly web browser with ad‑blocking and tracker‑blocking, or add a browser extension that does this work. Reducing web tracking lessens the impact of email linkage.
- Be more skeptical of messages arriving at any Hide My Email alias; treat them as if your real address might already be known to the sender.
- Monitor Apple’s security updates and changelogs so you can decide when to trust Hide My Email again, rather than assuming a silent background fix has solved the problem.
If you are serious about privacy, the lesson is clear: no single Apple feature should be your only shield. Combine better browser hygiene with independent aliasing or separate inboxes, and assume that anything labeled “beta” in spirit—even if not in name—can fail in surprising ways.
The Bigger Lesson: Don’t Outsource All Your Privacy to Marketing
The Hide My Email saga is bigger than one Apple privacy bug. It shows how easy it is to outsource judgment to a brand’s privacy slogans. A premium feature, bundled with a paid iCloud+ subscription, sounded like a safe bet, so many people stopped thinking critically about what it could expose if it failed.
Apple will likely fix this email address exposure, and in a year most people will forget it happened. You should not. Features that act as single points of anonymity—email relays, social sign‑ins, one‑tap logins—deserve extra scrutiny, precisely because they sit between you and the services that want your data. When they break, they break loudly.
The practical mindset shift is simple: treat privacy tools as helpful layers, not magic cloaks. Use Hide My Email once it is repaired, sure, but pair it with hardened browser settings, skeptical clicking habits, and a clear map of which aliases you use where. The more you understand the limits of each tool, the less likely you are to be blindsided when the next leak hits.
