Apple's Hide My Email leaked users' real addresses for over a year (easyoptouts.com)
EasyOptOuts says it reported two Hide My Email flaws to Apple in June 2025 that let a third party turn an alias back into your real iCloud address. Apple has twice claimed a fix; researchers say it was still broken as of June 30, 2026.
The firm won't publish the mechanism until it's patched, so the thread reverse-engineers it (a bounced oversized attachment is one guess), while an email engineer says Apple doesn't seem to know or care how its own mail systems behave.
Sign in to save