Apple Hide My Email is an iCloud+ feature that generates random email addresses which forward mail to a personal email account. The spam rejection leak reported by EasyOptOuts was verified fixed in July 2026, while addresses created before 7 July 2026 may still appear in third-party mail logs. Mail sent to a random address is forwarded to the personal email account, replies appear to come from the Hide My Email address, and addresses can be labelled, deactivated, or deleted, according to Apple Support. The leak mattered because it removed that separation in an error message.
Hide My Email and iCloud+
Hide My Email sits inside the paid iCloud+ subscription, not inside the free iCloud tier. A subscriber can generate unique, random email addresses in Safari, in Mail, in Apple Pay, in supported third-party apps, in Settings, in System Settings, and on the iCloud+ Features page on iCloud.com, according to Apple Support. Creation and management are documented across iPhone, iPad, and Mac, access on a device requires sign-in to the Apple Account on that device, and the feature requires iOS 15, iPadOS 15, macOS 12, or later.
A narrower Mail limit applies to mail sent with Hide My Email in Mail on iCloud.com, which can be delivered to a single recipient only, according to Apple Support. Deactivation, reactivation, and deletion are managed from the iCloud+ Features page on iCloud.com. A deactivated address stops forwarding. A reactivated address resumes forwarding, and a deleted inactive address cannot be reactivated, according to Apple Support. The mechanism is a forwarding link between a random address and a personal address, with Apple holding the mapping that makes forwarding and replies work, so an error message naming the receiving address disclosed the address the feature was designed to keep separate.
Finding and response
EasyOptOuts co-founders Tyler Murphy and Ben Weiner discovered the problem while investigating bounced mail sent to customers, and EasyOptOuts reported the issue to Apple on 11 June 2025, with detailed reproduction instructions on 13 June 2025. When mail sent to a Hide My Email address was rejected as spam, the rejection error message returned by iCloud mail servers included the meant-to-be-hidden email address in 100 percent of its limited tests, according to EasyOptOuts. The reproduction method in the same account is direct. A spam message is sent to the Hide My Email address. The message is rejected with SMTP code 550. The hidden address appears in the long description field of the error message. The most commonly observed codes were 550 5.7.1 and 552 5.7.0, and EasyOptOuts also reported a deleted-account error, 550 5.1.1, that included the hidden address. The 100 percent figure describes the limited tests, not a measured count of all Hide My Email users or all aliases, and how often hidden addresses leaked in mail logs in practice is not known.
Independent pre-fix verification came from 404 Media, which created a new Hide My Email address, sent it to Murphy, and received the real Apple account email behind it in around five minutes, as reported by MacRumors. The same five-minute verification and the same sequence of Apple replies were reported by TechSpot. Apple confirmed to EasyOptOuts that Hide My Email is not intended by design to allow discovery of the hidden address, and Apple told 404 Media that a patch released on 3 July 2026 fully resolved the issue. That statement and the 404 Media confirmation of the patch were reported by MacRumors, and the same 3 July 2026 deployment date was reported by The Hacker News. EasyOptOuts holds that the leak was real, repeatable, and present for more than a year, while Apple holds that the design did not intend the leak and that the July 2026 patch fully resolved it.
Chronology of the report and the fix
On 11 June 2025, EasyOptOuts discovered the issue in bounce logs and reported it to Apple. A customer had confirmed that the address in the logs was the meant-to-be-hidden address. EasyOptOuts records a detailed report on 13 June 2025, further message identifiers on 20 June 2025, a second related report on 9 July 2025 concerning the deleted-account error, and a first Apple acknowledgement that the vulnerabilities were under review on 14 July 2025. On 3 March 2026, Apple reported that the vulnerabilities were fixed and asked EasyOptOuts to verify, and on 19 March 2026 EasyOptOuts determined from the original reproduction instructions that the vulnerability had not been fixed. On 21 May 2026, EasyOptOuts asked for an update and suggested limiting new Hide My Email creation, and Apple replied that the investigation was continuing. On 26 May 2026, Apple replied that a fix was planned for a future security update in the coming weeks.
On 29 June 2026, EasyOptOuts disclosed the vulnerability to Joseph Cox at 404 Media, and on 30 June 2026 Apple again reported that the vulnerabilities were fixed, after which EasyOptOuts again found that the vulnerabilities had not been fixed. On 1 July 2026, 404 Media disclosed the existence of the vulnerability, and on 2 July 2026 Apple reported fixing the exposure in bounce messages from third-party mail servers, while noting continued investigation of broader error message concerns. The same sequence of discovery, delayed fix claims, and public disclosure was reported by Financial Express. On 6 July 2026, Apple made another update, and on 7 July 2026 EasyOptOuts found that known exploits had been fixed, with a variety of custom 5xx error messages also hidden in testing. On 14 July 2026, Apple confirmed to EasyOptOuts that the behaviour in the report, including edge cases, had been remediated. Some theoretical avenues remained untested on 7 July 2026, according to EasyOptOuts, alongside the finding that a variety of custom 5xx messages were hidden in testing and the Apple confirmation of remediation on 14 July 2026.
Residual risk in third-party logs
The fix stops new leaks through the reported mechanism, but the fix does not remove log entries created before July 2026. Rejection reasons are saved in third-party logs outside Apple control, EasyOptOuts itself retains such logs for only a few days, and some senders retain logs for months or years, or with no fixed retention limit. Hidden addresses were observed for Gmail, Yahoo, Outlook, and Proton domains, among others. A hidden address linked to a Hide My Email address created before 7 July 2026 may have been exposed. It may still be present in third-party logs. The same position, that pre-July addresses may have been exposed and may still be in third-party logs even though the bug itself has been fixed, was reported by Macworld.
Addresses created before 7 July 2026 may still appear in third-party mail logs. A patch stops new leaks. It does not erase existing log entries.
A person cannot reliably check a personal inbox or spam folder for evidence, because a rejected message often never reaches either folder, and EasyOptOuts states that how often hidden addresses leaked in mail logs is not known. A check of breach records remains possible through Have I Been Pwned, which lists breaches that included a given address, but a breach listing is not the same as a mail log entry, and a clean breach result does not prove that no log entry exists. Whether any attacker actively exploited the flaw before July 2026 is unconfirmed, and no public count exists in the sources checked of how many users or aliases were affected. No source checked confirms Apple notified affected users. EasyOptOuts argues that Apple should notify potentially affected users. That position is attributed to EasyOptOuts rather than a confirmed fact about Apple notification.
Structural limits of Hide My Email
Three structural limits remain after the fix, and none of them depends on the EasyOptOuts flaw. The first limit is the subscription gate. Hide My Email for arbitrary addresses requires a paid iCloud+ subscription, so access ends if the subscription ends, and the free iCloud tier does not include the feature. Apple lists Hide My Email among the features included in every iCloud+ plan, and Internxt summarises United States iCloud+ pricing at 0.99 dollars per month for 50 GB, 2.99 dollars for 200 GB, and 9.99 dollars for 2 TB, with higher tiers above those levels. Prices vary by country, and the structural point is the paid gate itself rather than any single price.
The second limit is the platform boundary. Creation and management are documented for iPhone, iPad, Mac, and iCloud.com, so use outside Apple hardware runs through iCloud.com in a supported web browser rather than through a native alias manager on that device, a route described by Incogni. The third limit is the single-mapping design. Every Hide My Email address forwards to a personal email account held in the Apple Account, so the privacy of the alias still depends on the security of that account and on the forwarding link itself. Deactivation and deletion control future forwarding, and neither action changes the destination inbox security or removes historical log entries. A separate legal development is reported without a verdict: MacRumors reports that Apple has been sued over the flaw, with plaintiffs seeking class action status and alleging a breach of California false advertising law and other consumer protection statutes. That report describes a claim, not a court finding.
AliasFleet email aliases
AliasFleet provides email aliases that are managed independently of a device operating system or a single mail provider. An alias can be assigned to one service, paused individually, or deactivated individually, so mail to that alias stops without affecting other aliases or the destination inbox. The alias model is a managed, persistent identity for each service. AliasFleet does not remove addresses already stored in third-party mail logs, and an alias does not change the security of the destination inbox itself. Those two limits sit in the same description as the function, because an alias controls future mail to that address and does not rewrite past log entries or past breach records.
Assessment on 24 October 2026
On the evidence available on 24 October 2026, the spam rejection leak reported by EasyOptOuts is fixed, with verification by 404 Media and by EasyOptOuts in July 2026. The period of exposure runs from at least June 2025 to early July 2026. Two Apple fix claims in that period did not hold on retesting. Addresses created before 7 July 2026 carry a residual risk from third-party logs that cannot be confirmed or cleared from an inbox alone. Hide My Email remains a paid, Apple Account based service, with deactivation and deletion as the controls for future forwarding.
Top comments (0)