Apple Sued Over Reported 'Hide My Email' Flaw

[Heelpir8]

What a joke of a lawsuit that will go nowhere. The feature works as advertised, it never claims your real email identity is completely protected.

Does this not sound like something that most Apple customers would interpret as such a claim?

https://support.apple.com/en-us/102548

"Hide My Email is a service that's included with an iCloud+ subscription. With Hide My Email, you can generate unique, random email addresses that automatically forward to your personal inbox, so you can keep your personal email address private."

 

[rweed]

Another possible lawsuit in the future now that Hide My Email accounts are being switched to just @icloud.com

Yup. Makes it easy for sites to detect.

 

[rjp1]

but there are no known instances of it being exploited

People exploiting things generally don't issue press releases letting you know 🤣

 

[Naraxus]

Sounds like Apple dropping the ball again.

Please explain. This ought to be good.

 

[HQuest]

Why don’t you go ahead and post your real email address here if you have nothing to hide?

hquest at yahoo dot com

Anything else, other than showing my age (who tf still uses yahoo?!)

Your turn. Unless you have things to hide. Like your cowardice.

 

[AgentOSX]

Since Day One, you can read the deep headers and find the non-disposable account ID.

 

[AgentOSX]

You don't have to be doing something wrong or illegal to expect privacy.

Discovery for this will be very interesting to see if the claim that Apple knew and still advertised it as safe, when in fact they knew it was not.

It was safe. The disposable email addresses are for donations or shopping, not so you can stalk and harass people.

 

[gummybear2026]

Please explain. This ought to be good.

So many examples. Siri, AI, iOS 26, hide my email flaw.

 

[scheming]

the day after the inital disclosure of the vulnerability via 404 media, sans isc podcast nonchalantly disclosed how to perform the exploit. im not sure if its detailed in any write ups, but apparently you just send an email with an oversized attachment and wait for the bounce back which will contain the actual address behind the "hidden" email address. good luck!

Apple ‘Hide My Email’ Vulnerability Reveals Peoples’ Real Email Addresses

”Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses,” the person who reported the issue said.

www.404media.co

SANS Stormcast Thursday, July 2nd, 2026: MetaMask Phishing; Adobe Patches; Google Chrome Patches; Apple Hide-My-Email Vuln

SANS Stormcast Thursday, July 2nd, 2026: MetaMask Phishing; Adobe Patches; Google Chrome Patches; Apple Hide-My-Email Vuln , Author: Dr. Johannes B. Ullrich Cybersecurity Podcast

isc.sans.edu

 

[Tres]

I know one person that cannot get my iCloud sent emails. have to my Gmail address

I thought I was the only one with this problem. Certain individuals just cannot receive emails sent from my iCloud address. At the same time, there are certain (different) individuals I cannot receive emails from.

There’s also been an issue where emails are received, are supposedly in the inbox, but only show up when searched for. This happens across devices. The only reason I knew this was happening was that I was expecting the email and thought to search for it.

How do you screw up something as basic as email?

 

[I7guy]

That when known bugs go unresolved for over a year, the PR narrative is more important than the actual functional effects.

There is no narrative and a handful of MR posters made up that Apple wasn’t about privacy because of a bug.

Very happy to see this lawsuit and hope to join the class action. I wonder though if the plaintiff actually knows what the vulnerability is or how it works? Reading the document doesn't seem like it.

Remember the FaceTime bug? It didn’t turn out as many thought it would.