Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs

Summary: Apple fixed a flaw in its Hide My Email service, deployed on July 3, 2026, that let users' real email addresses be unmasked when a message sent to a Hide My Email address was rejected as spam and the real address appeared in email logs. The issue was reported to Apple by EasyOptOuts co-founder Tyler Murphy on June 13, 2025, and Apple's earlier patch attempts in March and June 30, 2026 did not succeed.
Bottom line: EasyOptOuts told 404 Media it does not know how often hidden addresses leaked, and for many major email hosts the leak was triggered by a legitimate message being automatically rejected as spam, so it likely never reached the inbox and cannot be checked in a spam folder. Apple also faces a class action accusing it of charging for a privacy feature it failed to deliver and of not warning customers or pausing the service during the more than a year the flaw was known.

Read the original at The Hacker News ↗