Overview
- A proposed class action was filed on July 15 by plaintiff Anthony Alvarez in the U.S. District Court for the Northern District of California seeking certification for four classes and alleging false advertising, fraud and breach of contract.
- The complaint demands monetary relief exceeding $5 million in aggregate and asks the court to order Apple to fix Hide My Email or clearly disclose its limitations to users.
- Security researcher Tyler Murphy reported a flaw to Apple in June 2025, Apple acknowledged the report, and Apple said in March 2026 it had addressed the issue although the researcher continued to find the vulnerability.
- Independent testing published June 29 by 404 Media reproduced a way to link a Hide My Email relay alias to a real inbox but withheld technical steps to avoid enabling misuse, and reporting shows no publicly known real‑world exploit to date.
- Apple has not publicly responded to the lawsuit, the company has indicated a security update is planned and observers note a mid‑June backend migration of new relay addresses to private.icloud.com could affect how aliases behave and how courts assess harm and damages.