Apple’s “Hide My Email” feature has a bug that can expose your real email address. And it’s been sitting unpatched for over a year.
The vulnerability was found by EasyOptOuts co-founder Tyler Murphy. It lets someone with knowledge of the exploit unmask the anonymous alias and figure out who you really are. Murphy reported it to Apple with full replication instructions. Nothing happened.
In limited tests, 100% of Hide My Email addresses were exploitable. That’s not a typo — every single one.
The feature is supposed to prevent your real email from leaking in data breaches or getting linked to your identity. It creates random forwarding addresses so services never see your actual inbox. But if this bug is triggered, that protection evaporates.
Experts say malicious actors could use this to uncover identities behind anonymized emails. Apple says fixes are expected — but that’s what they said a year ago.
