Apple announced that the security flaw affecting the iCloud+ Hide My Email feature has been fully resolved, with a patch deployed to address the vulnerability.
The defect, first identified in June 2025, allowed the original email address to appear in bounced spam logs, potentially exposing it to unintended recipients. It was a low‑tech issue that failed to conceal the primary address in these logs.
Following a public disclosure in early July, Apple released the fix within days, preventing further exposure of addresses created before July 7 2026. The rapid response eliminated the method used to retrieve hidden addresses via spam logs.
Users with Hide My Email addresses generated prior to that date may still have their information stored in third‑party logs. Experts advise reviewing any accounts created with the feature and updating contact information where possible.
Hide My Email enables subscribers to generate unique forwarding addresses for online registrations, routing messages to the iCloud inbox while keeping the real address concealed from the service.
A class‑action lawsuit has been filed on behalf of iCloud+ subscribers, alleging damages for a privacy feature that did not meet the promised standards. The suit seeks compensation for users who paid for a service that failed to protect their email addresses as advertised.
