Apple has reportedly fixed a security flaw in its Hide My Email feature, which had made it possible for senders to uncover the real email addresses the iCloud+ tool was designed to conceal. The issue matters because Hide My Email is central to Apple's privacy-focused marketing, and the company had reportedly known about the vulnerability for roughly a year before addressing it, prompting scrutiny of its handling of the issue.

According to 404 Media, the flaw allowed a hidden address to be revealed if a message sent to it bounced as spam, and Apple deployed a patch on 3 July 2026 that it says fully resolves the problem. Tyler Murphy, who first flagged the bug to Apple in June 2025 and later alerted 404 Media after it resurfaced, warns that addresses created before 7 July may still be exposed in retained mail transfer logs. Apple now faces a proposed class action lawsuit seeking an injunction against its conduct and reimbursement of subscription fees, while Engadget said it was awaiting comment from the company.