Apple fixes iCloud+ vulnerability that exposed ‘hidden’ user emails

Apple fixed a vulnerability in the iCloud+ Hide My Email feature after 404 Media reported that the flaw let anyone access a user’s real email address. The feature is meant to keep the underlying address private by handing out relay addresses; the report showed that privacy barrier could be broken. 9to5Mac covered Apple’s response once the company said the issue had been addressed.

Hide My Email is an iCloud+ product mechanic: it issues disposable or forward-only addresses that relay mail to the subscriber’s real inbox so third parties never see the permanent address. The vulnerability sat in that chain. If a relay or related endpoint could be abused to recover the real address, the whole point of the feature failed, because exposure of the true address undoes the privacy layer users paid for and relied on.

For engineers and builders, this is a reminder that privacy features are attack surfaces, not just marketing labels. Relay systems, address mapping, and any path that can reverse or correlate a “hidden” identity with a real one need the same scrutiny as auth and session design. If your product issues aliases, masks, or one-time contacts, assume adversaries will try to reverse them and design so that mapping data and resolution paths are not reachable by unauthenticated or loosely authenticated clients.

In the broader market, Apple sells Hide My Email as part of a paid privacy bundle competing with other alias and relay tools. A public report that “hidden” addresses could be unmasked undercuts trust in that pitch more than a routine bug in a non-privacy feature would. Competitors and security researchers will treat this as another case where a flagship privacy claim did not hold under independent scrutiny until after disclosure.

What to watch next is whether Apple publishes a clearer technical description of the root cause and the fix, and whether similar reverse-lookup or correlation paths show up in other alias and relay products. Builders should re-check any email-masking or identity-hiding flow for unauthenticated resolution of real addresses, and treat “we fixed it” without a public postmortem as incomplete closure until the attack surface is documented.