Bug reportedly unmasks real email addresses

According to Murphy, every Hide My Email address tested during limited trials could be traced back to the user’s real email address. The researcher told 404 Media that all of the exploit attempts conducted with volunteer participants were successful.

“We don’t know the full scope of the issue, but in our limited tests with volunteers, 100% of Hide My Email addresses were exploitable,” Murphy reportedly said.

Murphy warned that if attackers are able to uncover someone’s primary email address, publicly available people-search databases could make it easier to connect that email to additional personal information, creating potential privacy and safety risks.

Not the first privacy concern

This is not the first time Apple’s privacy tools have faced scrutiny.

In 2022, the company was sued after reports claimed that certain iPhone apps continued sending analytics data to Apple even when users had disabled the iPhone Analytics setting.

A year later, security researchers also questioned the effectiveness of Apple’s Wi-Fi privacy protections, reporting that a feature designed to randomise device MAC addresses could still expose users’ real hardware identifiers under certain conditions.

While those issues differed technically from the newly reported Hide My Email flaw, they raised similar concerns about whether Apple’s privacy protections always function as advertised.

At present, there is no indication that the reported vulnerability is being actively exploited on a large scale, and researchers have deliberately withheld technical details to reduce the risk of abuse.