Apple Fixes Hide My Email Vulnerability After 404 Media Coverage - 404 Media

What the report says

404 Media reports that Apple has patched a vulnerability in its Hide My Email service that could reveal the real email address behind an anonymized iCloud address. According to the outlet, Apple said it deployed the fix on July 3 and considers the issue fully resolved. The report was published July 21, 2026, after 404 Media first covered the flaw earlier in the month.

Hide My Email is included with Apple’s paid iCloud+ subscription and is designed to let users create alias addresses for websites, services or individual contacts. 404 Media says Tyler Murphy, co-founder of EasyOptOuts, found that the aliases could be used to identify the underlying real address. Murphy reportedly notified Apple in June 2025, and the outlet says the company had been aware of the problem for more than a year before fixing it.

404 Media says it initially withheld technical details while the vulnerability was still open. After Apple’s patch, the outlet described the issue in broad terms as involving messages to a Hide My Email address that were rejected as spam. Murphy and EasyOptOuts co-founder Ben Weiner cautioned that some exposed address links could remain in third-party mail logs, particularly for aliases created before early July 2026.

The report also notes that a class action lawsuit has been filed against Apple over the vulnerability. Citing PCMag, 404 Media says the suit seeks reimbursement of subscription costs tied to the feature and court action over alleged deceptive conduct. The matter is significant because Hide My Email is marketed as a privacy tool, and the reported flaw could undermine users’ efforts to separate their identities across online services.