Apple Fixes Hide My Email Vulnerability That Exposed User Addresses

Apple has patched a security vulnerability in its Hide My Email feature that allowed users’ actual email addresses to be exposed, according to reports from TechRepublic and Mezha. The fix comes after the flaw remained unaddressed for approximately one year, leaving private identities vulnerable despite the service’s core promise of anonymity.

A Breach of Anonymity

The Hide My Email service is built to create unique, random email addresses that forward messages to a personal account without revealing the primary address to third parties. It is a digital mask.

That mask failed. As reported by Technology Org, the vulnerability bypassed the masking process entirely, effectively deanonymizing users by leaking their real contact information.

Legal Fallout Over Misleading Claims

The delay in deploying the patch has triggered legal action. MacRumors and 9to5Mac report that Apple is now facing a class action lawsuit alleging the company misled consumers regarding the privacy protections offered by the tool.

The lawsuit claims the existence and duration of the bug contradicted Apple’s marketing, which framed the feature as a secure way to protect personal data from third-party entities and trackers.

A Year of Exposure

The vulnerability struck at the fundamental architecture of the service. By exposing the underlying real address, the bug rendered the tool’s primary privacy barrier ineffective.

Apple has released the fix, but the timeline remains a central point of contention. TechRepublic emphasizes that the yearlong gap between the identification of the bug and the final patch left a significant window of exposure for the user base.

Impact on iCloud+ Subscribers

This failure highlights a discrepancy between the promised functionality of Apple’s privacy suite and its technical reality. Because the service is integrated into iCloud+ subscriptions, the flaw affected a broad segment of paying users who rely on the feature for data privacy.

The class action lawsuit specifically targets the company’s claims about the efficacy of these protections. It suggests users were sold a service that simply did not perform as advertised while the vulnerability existed.