Overview
- Independent researchers Ben and Tyler Murphy reported in June 2025 that Apple's iCloud+ feature Hide My Email leaked users' real addresses when incoming messages bounced.
- Apple attempted multiple fixes over more than a year and implemented a corrective server configuration in early July 2026 that appears to stop bounce-based deanonymization for new aliases.
- The researchers say aliases created before about July 7, 2026 may have been exposed because bounce messages and long‑retained mail logs can record the real recipient address.
- A proposed class-action lawsuit, Anthony Alvarez v. Apple (Case 3:26-cv-07274), was filed in the U.S. District Court for the Northern District of California on July 15, 2026 seeking damages, injunctive relief and class certification.
- The episode highlights how a paid privacy feature can fail in practice and signals possible wider consequences for subscribers who cannot tell if older aliases or retained logs contain identifying data.