Apple's Hide My Email leaked users' real addresses for over a year
A researcher hands you a brand-new Hide My Email alias. Minutes later he reads back the real iCloud address it was supposed to hide. EasyOptOuts says Apple has known about the flaw for more than a year.
EasyOptOuts says it reported two Hide My Email flaws to Apple in June 2025 that let a third party turn an alias back into your real iCloud address. Apple has twice claimed a fix; researchers say it was still broken as of June 30, 2026.
The firm won't publish the mechanism until it's patched, so the thread reverse-engineers it (a bounced oversized attachment is one guess), while an email engineer says Apple doesn't seem to know or care how its own mail systems behave.
Apple has known its email cloak leaks for over a year
Hide My Email is supposed to hand a website a throwaway @icloud.com alias so it never sees your real address. EasyOptOuts' co-founders say they found two separate flaws that let an outside party turn that alias back into your true iCloud address, and reported the first to Apple in June 2025.
The disclosure timeline is the story. Apple said the issues were fixed in March 2026; the researchers reproduced the leak days later. Apple claimed a fix again on June 30, 2026; the researchers say it still works. They are holding back the mechanism on purpose:
"To protect the privacy of Hide My Email users, we will not discuss or disclose the details of the exploits until they're fixed." — the EasyOptOuts disclosure writeup
The thread tried to fill in the blank
With no mechanism published, commenters reverse-engineered one:
"you send an email with a very large attachment to a 'hide my email' address… sends a response email (from the real address) with the rejected email message." — a commenter offering an untested but concrete guess
Someone who runs mail infrastructure said the sluggish response fit a pattern:
"They don't seem to know or care what is going on with their own email systems." — a director of engineering at an email-security firm
Not everyone was sure the hole is real:
"It's hard for me to assess how real this risk is. Without details, we're just extrapolating from circumstantial vibes." — a commenter urging caution without the technical details
The sting is who is exposed: people reach for Hide My Email precisely on the accounts where the underlying address, often the Apple ID itself, is the most sensitive thing to leak.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Judge lets 29 states take Meta to trial over child addiction claims
A federal judge in Oakland just told Meta that whether Instagram is engineered to addict children is a question for a jury, not a motion to dismiss. Trial is set for August 18.