Apple’s Hide My Email feature has a bug that’s been exposing real email addresses, researcher claims

A significant privacy concern has emerged regarding Apple's Hide My Email feature, which is designed to protect users' real email addresses by providing disposable alternatives for online interactions. Recent findings suggest that a critical bug within this system allows the actual email addresses of users to be revealed. The issue was highlighted by 404 Media, which conducted tests confirming the existence of this vulnerability. Researcher Tyler Murphy, who identified the flaw, stated that he alerted Apple to the problem over a year ago, yet it remains unresolved. According to Murphy, every attempt to exploit this bug has been successful. "In our limited tests with volunteers, we found that 100% of Hide My Email addresses were exploitable," he reported. Due to the potential risks, detailed information about the vulnerability has not been made public to prevent malicious exploitation. Murphy, who is also the co-founder of EasyOptOuts—a service that removes personal information from data broker sites—expressed concerns about the implications for privacy. He noted that easily accessible people-search websites could link an email address to other personal information, putting those who rely on Hide My Email for safety at risk. TechCrunch has reached out to Apple for comments and will provide updates if the company responds. The tech industry has seen its fair share of privacy-related issues, and Apple has faced scrutiny in the past for similar reasons. Notably, the company was sued in 2022 for allegedly collecting analytics data from iPhone apps even when privacy settings were enabled. Furthermore, in 2023, researchers criticized another privacy feature intended to anonymize users' Wi-Fi connections, revealing that it exposed users' actual MAC addresses instead. With privacy being a cornerstone of Apple's brand identity, it is crucial for the company to address this Hide My Email bug swiftly. Strengthening its commitment to user privacy could positively impact its reputation in an increasingly privacy-conscious digital landscape.