Major Apple Bug Appears to Disclose All Real Emails for 'Hide My Email' Users

Apple is facing a privacy and security setback after a reported vulnerability in its iCloud+ Hide My Email feature allegedly allows attackers to uncover users’ real email addresses. According to the report, the issue has existed for over a year despite Apple saying it had addressed it in March 2026 and still investigating it by May 2026. The article says volunteers tested the flaw and found all Hide My Email aliases could be linked back to real addresses using basic identity-search tools. The news is negative for Apple’s privacy branding because it undermines a feature designed to protect users from spam, tracking, and account exposure. Apple is also planning updates to the tool this summer, including a domain change from icloud.com to private.icloud.com, which could affect how sites block aliases and reduce the feature’s usefulness.