A new lawsuit filed against Apple over a security flaw in the “Hide my email” feature

Two weeks ago I wrote about A Apple iCloud error Hide my email A tool that emerged to reveal users’ real email addresses to anyone who wanted to find them. On Wednesday, a lawsuit was filed in California, Alvarez v. Apple Incaccusing Apple of false advertising, fraud, and breach of contract for selling a privacy feature it allegedly couldn’t provide.

Read more: The best iPhones of 2026

the Hide my email The feature, which lets you create a temporary, anonymous email address using an iCloud.com domain, is often used to protect privacy when signing up for subscriptions or signing in to new or unverified websites. The feature is currently available at a paid price iCloud Plus subscription.

The lawsuit claims that a known vulnerability in Hide My Email exposes real email addresses behind randomly generated email aliases. The lawsuit says Apple was made aware of the flaw by a security researcher in June 2025, but left the issue unresolved while continuing to advertise the feature as a secure privacy tool.

The lawsuit, which seeks class-action status, requests a jury trial and states that the value of the claims is greater than $5 million. In addition to seeking financial damages, the lawsuit also asks Apple to fix the Hide My Email vulnerability or disclose its limitations.

An Apple representative did not immediately respond to a request for comment.

The bug was discovered by It’s easy to unsubscribe And report it 404 mediaAlthough the details of the flaw have remained largely hidden. Research has found that basic online identity lookup tools can analyze temporary iCloud email addresses and reveal users’ real addresses. 404 Media reported that 100% of the Hide My Email addresses on the two sites tested were exploitable.

This is why the vulnerability is serious. Once the malicious actor has this real email address, they can connect it to any public database available online to reveal the user’s name, address, phone number and other sensitive details. It can also be used to access lists of passwords sold from large-scale data leaks.

It’s worth noting that Apple is planning changes to Hide My Email that could make it less friendly to privacy advocates. Apple’s own reports It says it will update the tool later this summer to switch addresses from “iCloud.com” to “private.iCloud.com.” This could allow websites to filter out new addresses, forcing Apple users to either replace their real address or use a third-party temporary website tool instead.

If you use Hide My Email and are concerned about your email being exposed, be patient: such lawsuits must go through a lengthy certification process by a court, so it will take some time before they are open for joining, if at all. This suit is divided into Apple users in California and the United States. I’ll let you know when it’s possible to join, and who can sign up.