Overview
- A verification published on Wednesday showed a researcher could recover the real email behind an Apple Hide My Email alias within minutes using a test address.
- The flaw was first reported to Apple in June 2025 by researcher Tyler Murphy, who says he supplied replication steps and waited more than a year for a fix.
- Apple told the researcher in March 2026 that a recent system change had addressed the problem but the researcher and follow‑up tests found the issue remained, and Apple has said it is still investigating.
- Apple is moving relay aliases to the private.icloud.com domain and has told developers and mail operators to update allowlists and routing, a change that standardizes infrastructure but may make aliases easier for sites to detect or block.
- If exploited at scale the flaw could let people‑search services and attackers link hidden aliases to real accounts, raising doxxing and privacy risks for users and creating operational pain for services that must change email filters and signup rules.