Turns out the “Hide” part of Hide My Email wasn’t doing its job quite as advertised, something that I covered early in July. Security researcher Tyler Murphy reported the flaw in June 2025, but despite Apple claiming it was resolved in March 2026, independent tests confirmed it remained exploitable, at least until July 3, 2026.
So how did this bug actually work?
The flaw meant that if someone sent a message to your hidden address and it bounced as spam, even a completely legitimate email, your actual email address could get exposed in the sender’s mail logs.
You wouldn’t even know it happened. A bounced message never lands in your inbox for you to notice. Murphy first flagged the bug to Apple back in June 2025. Apple told him in March 2026 it had been resolved, but it hadn’t. Fast forward to early July, and 404 Media went public with the story.
Apple shipped an actual fix just two days later, on July 3. Make of that timing what you will. “The bug that caused Apple’s Hide My Email to leak hidden email addresses to senders has been fixed,” reports 404 Media.
Is the issue resolved entirely?
However, the outlet warns that email addresses linked to Hide My Email aliases, especially those created prior to July 7, 2026, may still reside in retained third-party mail logs. Apple’s also now facing a lawsuit seeking class action status, accusing the company of violating California consumer protection law by selling a feature that didn’t work as promised.
This pattern, quietly acknowledging a flaw internally while telling the reporter it’s fixed when it isn’t, echoes complaints commenters raised about Apple’s App Store moderation only responding to public pressure.
Privacy features marketed as premium selling points invite exactly this kind of scrutiny, and a pending class action means Apple’s handling of the timeline will matter as much as the fix itself.