A Hide My Email bug exposed real addresses through bounced spam messages for over a year before Apple patched it, just days after public exposure.
A year-old vulnerability in Apple’s Hide My Email can expose users’ real email addresses. Apple claimed to fix it in March 2026. Independent testing shows it wasn’t fixed.
In the coming weeks, Apple will move anonymously generated emails addresses to a different domain.