Since the introduction of premium iCloud+ in 2021, Apple has offered a privacy-centric feature for its users dubbed Hide My Email. Conceptually, Hide My Email allows iCloud+ users to create anonymous burner email accounts that can't be tied back to their original email accounts, but a vulnerability was found in June 2025 that allows the original account to be found anyway. Seeing as this nullifies the main benefit of Hide My Email entirely, privacy advocates are rightfully concerned.

To make matters worse, per statements made to 404 Media by co-founder of EasyOptOuts and exploit finder Tyler Murphy, Apple still has yet to fix the issue. Last Murphy heard, it was meant to be fixed within "the coming weeks" at the end of May, but here in July the fix has yet to arrive. That means for a solid year, Apple has been aware of the issue but still has not fixed it.

Official iCloud Mail graphic.

Per the 404 Media coverage and Murphy himself, it's not that Apple has been ignoring the problem entirely. Apple even claimed to have fixed the issue in March, and implored Murphy not to disclose it to "avoid placing our customers at risk" once he discovered the exploit still existed. With this year's earlier iCloud data breach and plans to convert Hide My Email emails to an obvious "@private.icloud.com" domain though, it's a bad look for Apple.

Numerous security and stability issues have also cropped up with iCloud throughout the years, including the infamous "Zombie iPhone" bug and the unceremonious shuttering of My Photo Stream potentially deleting user photos. A problem as egregious as Hide My Email not hiding your email for the premium iCloud+ service is just another entry on the list.

Hopefully, Apple is listening to the criticism and will iron out the issue enabling attackers to find the original emails behind Hide My Email accounts soon. Perhaps then it may also reverse course on rebranding those accounts with such obvious "this is a burner" flags, but only time will tell. Apple had no response to 404 Media's requests for comment.