A 26-year-old man found out the hard way that Apple’s Hide My Email feature didn’t conceal his identity when he threatened the girlfriend of FBI Director Kash Patel in February.
Apparently, that anti-anonymous loophole doesn’t just work for federal officials. New information suggests that Apple’s Hide My Email doesn’t hide anyone’s identity, even from websites and marketers as it was originally intended.
Your real address and name may be visible.
So what went wrong?
Hide My Email’s privacy problem
Apple unveiled Hide My Email in 2021 as part of its extended iCloud+ paid subscription. During its WWDC keynote event, then-VP of Apple Cloud Services, Mike Abbott, said, “We’ve all had moments where we’ve thought twice about sharing our personal email address, like when we’re filling out a form on the web. With Hide My Email, you can share a unique random address that forwards messages to your personal inbox, and it’s built right into Mail, Safari, and iCloud settings. So it’s easy to set up as many addresses as you need and delete them at any time, keeping you in control.”
This statement was made during a keynote segment dedicated to “another part of our ecosystem that puts your privacy first,” according to Apple’s Senior Vice President of Software Engineering, Craig Federighi. Apparently, that was just marketing fluff.
As reported by 404 Media, Tyler Murphy, co-founder of a personal data removal service EasyOptOuts, unearthed Hide My Email’s one glaring privacy flaw. He made the harsh claim that, “Apple Hide My Email is leaking email addresses that are supposed to be hidden. We reported the issue and replication instructions to Apple over a year ago. We don’t know why it hasn’t been fixed, but we don’t feel comfortable waiting any longer. Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses.” He concluded with a warning, “Free, publicly accessible people-search sites make it easy to link an email address to other personal details, so people relying on Hide My Email for safety may be at risk.”
Apple is reportedly investigating the claim, and despite recent software patches for iOS, iPadOS, and macOS, the problem has not been fixed.
A privacy-first facade
It’s important to note that this issue is different from the story we covered earlier this year involving Kash Patel’s girlfriend (Alexis Wilkins) and the FBI. In this case, the FBI requested that Apple provide the primary email address and name of the person who was sending threats to Wilkins to charge him for a crime. Although this wasn’t known at the time, Hide My Email addresses are not concealed within Apple’s servers, giving them the ability to link alias accounts to their original creators. (So much for privacy first, huh, Craig?)
RELATED: Is Google tweaking Android to listen in on you all the time?
Yuliia Kaveshnikova/Getty Images
Third-party websites and hackers, on the other hand, don’t have access to Apple’s servers and shouldn’t have the power to draw the same correlations. Yet, this is Murphy’s claim: That all Hide My Email aliases can be traced to their creators and the service actually doesn’t do anything at all.
What should you do?
If you’re a Hide My Email user and you’re relying on it for some sense of anonymity on the web, think again. Your real address and name may be visible. Since Apple has failed to fix the problem, it’s best to refrain from using the service for now. There are potential alternative options available through third-party email providers, but if we’re being honest, nothing on the internet is completely anonymous or private, so it’s hard to recommend those either.
If you think this whole thing has class-action lawsuit written all over it, you’re right! A case has already emerged. Filed by Anthony Alvarez, the suit goes after Apple on several counts, including negligent misrepresentation, breach of contract, and fraud.
The suit notes that the vulnerability was originally brought to Apple’s attention in June 2025, an entire year before the problem was revealed to the public by Murphy. Adding insult to injury, the suit claims that Apple reported a fix for the issue in March 2026, yet the problem still remained an active threat, at which point Apple covered up the flaw again.
Only time will tell if Apple gets into any real legal trouble over the Hide My Email debacle. In the meantime, it’s best to stay away from it entirely.
Apple, Privacy, Security, Identity, Tech
