# Apple's Privacy Shield Had a Hole in It for Over a Year
For users who relied on Apple's Hide My Email to keep their real address out of reach — from spammers, data brokers, advertisers — the feature worked exactly as advertised. Except when it logged your actual address in plaintext.
That's the short version of a vulnerability disclosed by Tyler Murphy, co-founder of EasyOptOuts, and quietly patched by Apple on July 3, 2026 — more than a year after Murphy reported it. The bug lived inside Apple's Mail app: under certain conditions, the real email address behind a Hide My Email alias showed up in local mail logs, even when the alias was doing its job at the network level.
## What the Feature Is Supposed to Do
Hide My Email launched with iCloud+ in 2021 as Apple's answer to a real problem: email addresses are forever. Once you hand one to a retailer, a newsletter, or a SaaS signup form, you lose control of it. The feature generates a random alias — something like crinkled.mint.9a@icloud.com — that forwards to your real inbox. You can burn the alias if it gets spammed. Your real address stays hidden.
It's a genuine privacy tool, not a marketing checkbox. Security-conscious users adopted it specifically because they trusted Apple's privacy brand. That trust had a gap.
## The Leak Nobody Was Looking For
Mail logs are not something most users think about. They're low-level diagnostic files — the kind of thing you'd only crack open if something was broken, or if you knew to look. Murphy found that when Apple Mail processed messages through a Hide My Email alias, the real destination address could appear in these logs.
The implications depend heavily on your threat model. For an ordinary user, local mail logs are obscure. But "local" is doing a lot of work in that sentence. Shared family devices, enterprise MDM environments, forensic tools, malware with filesystem access — any of these could surface that log data. For users who adopted Hide My Email precisely because they were worried about exposure, the idea that their real address was sitting in a plaintext file is not a theoretical problem.
Apple's fix landed July 3. Murphy had filed the report sometime in early 2025. The gap between disclosure and patch was over a year.
## The One-Year Wait
Apple has a reasonably functional security response process by industry standards. Its Security Research Device Program, its published acknowledgments, its consistent patching cadence — these are real. So a 14-plus month delay on a privacy bug in one of its flagship privacy features is worth pausing on.
Privacy bugs are not always treated with the same urgency as remote code execution. They often don't generate splashy CVE scores. They don't get called "critical" in the way that a kernel exploit does. But for the user who turned on Hide My Email because they were leaving an abusive relationship, or because they'd already had their primary email scraped and sold, the severity calculus looks different.
The delay also meant the window for potential exposure was long. Users had no way of knowing their logs were leaking something they'd deliberately chosen to conceal.
## Defenders, Device Hygiene, and What Comes Next
If you're a Hide My Email user, the patch is live. You don't need to rotate your aliases — the leak was local, not a server-side disclosure of your real address to third parties. But this episode is a useful reminder that privacy features are software, and software has bugs.
A few things worth doing:
For organizations that let employees use personal Apple devices for work email — a common BYOD reality — this is a gentle reminder that local diagnostic logs are a data surface. They belong in your endpoint security thinking, not just your server security thinking.
---
## HackWire Analysis
There's a pattern worth naming here: Apple's privacy-as-differentiator strategy has created an expectation that its privacy features are held to a higher standard than competitors'. That's not unfair — Apple has actively cultivated it. But it also means that when a privacy tool leaks the thing it's supposed to protect, the gap between marketing and reality is unusually sharp.
What's missing from most coverage of this story is the disclosure timeline framing. A year-plus delay on a privacy vulnerability doesn't get the same heat that a year-plus delay on a memory safety bug would get. The security community has developed good intuitions about what constitutes an unreasonable patch lag for a code execution bug. We haven't built the same consensus around privacy bugs. We probably should.
EasyOptOuts is a data broker opt-out service — Murphy's professional context here matters. He works in the space of reducing personal data exposure, and he found this bug in the course of that work. That's a good story about independent researchers doing real privacy work, not just chasing CVEs.
The broader trend: Apple's expansion of privacy features — Hide My Email, Private Relay, Advanced Data Protection — creates a larger attack surface for privacy-specific bugs. Each new feature is another layer where the gap between what users believe and what the system actually does can widen. The right response isn't to build fewer privacy features. It's to treat privacy bug severity with the same seriousness as security bug severity — and to patch on a timeline that reflects that.
One year is too long. Especially when the feature's entire value proposition is keeping something hidden.
— HackWire Editorial
---
## Related Coverage