Apple's Hide My Email feature reportedly has a bug exposing real email addresses

A bug in Apple's Hide My Email feature, designed to protect user privacy by creating disposable email addresses, may be exposing users' real email addresses, according to new research. The vulnerability was reported by 404 Media, which verified the bug's existence through testing.

Researcher Tyler Murphy, co-founder of the data-removal service EasyOptOuts, stated that he had warned Apple about the issue more than a year ago and expressed surprise that it remained unaddressed. Murphy indicated that in limited tests, all instances of the Hide My Email feature were found to be exploitable. The specific details of the vulnerability have been withheld from public disclosure to prevent malicious actors from exploiting it.

Murphy highlighted that the exposure of real email addresses poses a significant risk, particularly for individuals who rely on Hide My Email for safety and anonymity. He noted that publicly available people-search sites can easily link an email address to other personal information, potentially compromising users' privacy.

This alleged flaw in Apple's privacy features comes amid a history of similar criticisms. The company faced a lawsuit in 2022 over reports that iPhone apps continued to send analytics data even when privacy settings were enabled. In 2023, another Apple privacy tool, intended to randomize MAC addresses for Wi-Fi connections, was found by researchers to be exposing users' real MAC addresses.

Apple has built a significant portion of its brand identity around user privacy, making the resolution of this apparent bug in Hide My Email a critical concern for maintaining customer trust.