Overview
- Security researcher Tyler Murphy first reported the Hide My Email weakness to Apple in June 2025 and researchers pressed the company for more than a year before the issue was made public.
- Apple told reporters it deployed a patch on July 3, 2026 that it says fully resolves the bug that could reveal a user’s real address behind an iCloud+ alias.
- The flaw worked by causing a recipient’s permanent email to appear in mail transfer or bounce logs when a message to a Hide My Email alias was rejected as spam, which could link an alias to a real inbox without exposing passwords or message contents.
- Researchers caution any alias created before July 7, 2026 should be treated as potentially exposed because third‑party mail servers often retain bounce and delivery logs that Apple cannot erase.
- A proposed class action filed in California seeks refunds and injunctive relief over Apple’s privacy claims, and independent testing has raised questions about the timing and completeness of Apple’s rollout.