Phoenix 24
Privacy tool now faces difficult trust questions.
CUPERTINO, UNITED STATES — July 2026.
Apple’s “Hide My Email” feature is facing renewed scrutiny after reports that a vulnerability can reveal the real email address behind an anonymous alias. The tool was created to protect privacy by allowing users to register on websites, apps and online services without exposing their personal inbox. Instead of sharing the real address, Apple generates a random forwarding address that receives messages and sends them to the user’s actual account. The reported flaw raises a serious concern because it could undermine the core promise of one of Apple’s most visible privacy functions.
The vulnerability was identified by Tyler Murphy, cofounder of the privacy service EasyOptOuts, who reportedly notified Apple in June 2025. Apple acknowledged the report the following month and later indicated that a system change had resolved the problem. Murphy then tested the feature again and concluded that the vulnerability remained active despite Apple’s statement. According to subsequent independent testing, a newly generated hidden address could still be linked to the real Apple account email within minutes.
Technical details of the vulnerability have not been publicly released because the flaw reportedly remains exploitable. That decision limits the ability of ordinary users to understand the mechanism, but it also reduces the chance that malicious actors will copy the method at scale. Security researchers often withhold exploit instructions when publication could immediately increase harm before a patch is available. The public warning therefore focuses on risk awareness rather than providing a step-by-step explanation of how the exposure occurs.
“Hide My Email” is especially important because it is built into Apple’s broader privacy ecosystem and is promoted as a practical defense against tracking, spam and data leaks. When a service, store or application receives only a random alias, it should not be able to connect that address to the user’s personal identity. If the alias can be reversed or associated with the Apple ID email, the separation between public-facing registration and private identity becomes weaker. That weakens trust not only in one feature, but also in the privacy architecture surrounding Apple accounts.
The exposure of a real email address can create risks beyond unwanted messages. Email addresses often serve as identifiers across social networks, shopping accounts, banking portals, cloud services and public data broker databases. Once an attacker obtains the real address, it may be possible to connect it with names, phone numbers, approximate locations or other personal records already available online. This can lead to phishing, profiling, harassment, account-targeting and more convincing social-engineering attacks.
The timeline has intensified criticism because the issue was reportedly known to Apple for more than a year before public attention increased. Apple allegedly requested more time to investigate and indicated that a future security update would address the problem. Privacy advocates argue that users should have been warned sooner if a feature advertised as identity-protective could fail in this way. The case highlights the tension between coordinated vulnerability disclosure and the public’s right to know when a protective tool may not be providing the expected level of protection.
The situation also arrives as Apple prepares changes to the domains used by anonymous email addresses. Moving hidden addresses to a more recognizable private domain could make the system easier for websites to identify and potentially block. That change may help technical management, but it could reduce the practical usefulness of aliases if services refuse to accept them during sign-up. Users could then face two problems at once: possible exposure of their real address and reduced acceptance of privacy-protective alternatives.
For now, users should avoid treating “Hide My Email” as a complete anonymity solution when registering for sensitive services. The feature may still reduce spam and help isolate accounts, but it should not be relied upon as the only barrier between a public alias and a personal identity. People using hidden addresses should review which apps and websites are connected to those aliases through Apple account settings. It is also prudent to delete unused aliases, monitor suspicious messages and avoid using the feature where exposure could create professional, legal or personal risk.
Two-factor authentication remains essential for protecting an Apple ID, but it does not solve the privacy problem created by a discoverable address. Users should ensure that their Apple account password is strong, unique and not reused on any other service. They should also remain alert to targeted messages that reference services connected to hidden aliases, because attackers may use the exposed address to make phishing attempts appear more credible. Operating system updates should be installed promptly once Apple releases any security correction related to the issue.
The incident is a reminder that privacy tools require the same transparency and urgency as traditional cybersecurity defenses. A function designed to conceal identity can create a false sense of safety if users are not informed when its protections are uncertain. Apple’s reputation has long depended on presenting privacy as a product principle, which makes any unresolved weakness in a flagship privacy service especially damaging. Until a definitive fix is confirmed, “Hide My Email” should be used cautiously, with the understanding that an alias may not fully conceal the real address behind it.
Phoenix24 — Global news with clarity and perspective.