- Apple fixed a vulnerability in its Hide My Email feature that allowed revealing users' real email addresses, after being aware of the issue for over a year.
- The fix was deployed on July 3, 2026, shortly after 404 Media reported the vulnerability, despite Apple knowing about it since June 2025.
- A class action lawsuit has been filed against Apple seeking refunds of subscription costs and an injunction over the company's handling of the vulnerability.
- The exploit worked by sending a targeted user a message that was rejected as spam, which leaked the real email address in email logs.
- Even after the fix, the risk may persist because past email logs could still contain leaked addresses, potentially affecting users who created Hide My Email addresses before July 7, 2026.