Apple's Hide My Email Feature Has Unpatched Flaw That Exposes Real Addresses

Executive Briefing

• Reveals vulnerability allows 'almost anyone' to discover real email behind Hide My Email aliases via public people-search sites
• Demonstrates exploit worked in under five minutes, successfully identifying a journalist's real address from an alias
• Confirms Apple has known about the flaw since June 2025, falsely claimed a patch was issued in March 2026
• Raises concern that planned domain change to @private.icloud.com will further undermine alias anonymity
• Urges Apple to act swiftly as the security investigation reportedly remains ongoing as of May 2026