A vulnerability in Apple's Hide My Email service, first reported in June 2025, can expose users' real email addresses behind generated aliases, and Apple has yet to fix the issue despite ongoing investigation. The flaw was confirmed to be exploitable in all tested cases, raising concerns about user privacy since exposed email addresses can be linked to personal information via public people-search databases. Apple has stated a fix is expected soon but has not suspended new alias creation or fully resolved the problem more than a year after its discovery.
https://www.macrumors.com/2026/07/01/hide-my-email-vulnerability-exposes-real-addresses/