Major Apple Bug Appears to Disclose All Real Emails for 'Hide My Email' Users

A bug in Apple's privacy-centric Hide My Email feature is inadvertently disclosing the very information it was designed to protect: users' real email addresses. Discovered by security researchers and reported by CNET, the flaw affects iCloud+ subscribers who rely on Apple's anonymized email forwarding service. The bug, which surfaces in email headers, allows attackers to bypass the anonymity of Apple's proxy system and view the actual iCloud account behind a random address. Hide My Email, part of Apple's iCloud+ subscription, generates unique, random email addresses that forward messages to a user's real inbox. It is a cornerstone of Apple's privacy pitch, marketed as a way to sign up for services without revealing personal data. The vulnerability undermines that promise. According to CNET's reporting, the bug manifests when a user replies to or composes an email through the generated address. In certain scenarios, the real email address is embedded in the message headers, visible to any recipient with basic email inspection tools. This means that any sender who receives a reply from a Hide My Email address could potentially retrieve the user's actual address. The flaw impacts all iCloud+ tiers, which start at $0.99 per month and include users of Apple's paid storage plans. With over 400 million iCloud+ subscribers worldwide, the potential exposure is vast. Apple has not yet issued a public statement or released a patch. Security experts recommend that users disable Hide My Email for sensitive accounts until a fix is deployed. The Hide My Email bug is the latest in a series of privacy stumbles for Apple, which has built its brand around data protection. In 2021, the company introduced iCloud+ features including Private Relay and Hide My Email to differentiate itself from Google and Facebook. This vulnerability could erode user trust, especially among privacy-conscious customers. As of now, there is no confirmed timeline for a fix. Apple typically responds to such vulnerabilities with server-side changes or iOS updates. Users are advised to monitor Apple's security advisories and consider alternative temporary email services for high-stakes sign-ups. The incident underscores the fragility of even the most polished privacy features when bugs go undetected.