Back to Feed
VulnerabilitiesJul 21, 2026

Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs

Apple fixes Hide My Email bug exposing real addresses in mail logs.

Apple has patched a vulnerability in its Hide My Email service that could expose users' real email addresses in mail logs when emails were rejected as spam. The flaw was reported over a year ago and was fixed on July 3, 2026, after multiple unsuccessful attempts. This fix comes as Apple faces a class-action lawsuit alleging it misled customers about the privacy of the feature.

AI summary of the linked source. Not reviewed by an editor. How this works

Vendor Watch

Run Apple?

Get an email when a new story names Apple, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy

The lesson from this incident

Full lesson

A vulnerability in Apple's Hide My Email privacy feature inadvertently exposed users' real email addresses within mail logs whenever messages were rejected as spam, directly undermining the core privacy promise of the service. Critically, the flaw was reported over a year before it was patched, highlighting a dangerously slow remediation lifecycle for a privacy-critical feature. Sensitive personal data appearing in logs is particularly harmful because logs are often stored, replicated, and accessed by multiple parties, widening the exposure surface significantly. This incident illustrates that privacy-enhancing features must be held to the same — if not higher — security standards as other system components, and that delayed patching of known privacy vulnerabilities carries real legal and reputational consequences.

What helps against this

How we list vendors

Entities

Hide My Email (product)Apple (vendor)iCloud+ (product)