Apple Patches iCloud+ Email Flaw After 1 Year, Facing Class Action

Q: The email bug is patched, but are your old 'hidden' addresses still traceable in third-party server logs?

Yes. The patch stops new exposures, but it does not erase data that may already have been written to outside systems. Apple says it fixed the Hide My Email flaw on July 3. But researchers Tyler Murphy and Ben Weiner have warned that aliases created before roughly July 7, 2026 may already have been exposed, especially through bounced or spam-rejected messages. If that happened, the real address could have been recorded in third-party mail transfer logs, anti-spam systems, or server logs during message handling. That means an old hidden alias can remain traceable in two ways. The alias itself may still sit in a company’s historical logs because businesses routinely retain email and security records. More importantly, if the bug revealed the underlying real address during a bounce or rejection event, that real address may also persist in those logs. A software fix at Apple does not retroactively delete records held by other companies. What is not clear is how often this happened in the wild. 404 Media verified the flaw, and Murphy said tested aliases were vulnerable, but there have been no confirmed public reports of widespread malicious exploitation. Even so, the privacy risk for older aliases is not necessarily over just because the bug is patched. For users, the practical step is to treat pre-patch aliases as potentially compromised: stop using sensitive older aliases, create new ones after the fix, and watch for spam or account-linking attempts tied to your real address.

3 articles · Updated · 404 Media · Jul 21

July 3 marked Apple’s patch for a Hide My Email flaw that could reveal users’ real addresses, a fix the company confirmed after 404 Media reported the issue.
June 2025 was when researcher Tyler Murphy first alerted Apple; he later found the bug still worked, and limited tests showed 100% of sampled Hide My Email addresses were exploitable.
Spam rejections triggered the leak: sending a message that got bounced could expose the linked real address, and Murphy said affected users may never have seen those messages in their inboxes.
Murphy and EasyOptOut warned the risk may linger because mail-transfer logs are often retained, so aliases created before July 7, 2026 may already have been exposed in third-party records.
A proposed class action now seeks refunds for iCloud+ subscription costs tied to the feature and an injunction over what it calls Apple’s deceptive conduct.