Hide My Email Was Leaking: What To Do Now (2026 Guide)

The #1 mistake people are making right now with the Hide My Email vulnerability: reading the headline, seeing “Apple fixed it,” and closing the tab. The patch matters. But if you’ve been generating aliases since 2021, the fix doesn’t reach backward – and that’s the part nobody’s spelling out.

Here’s the story, and here’s the actual audit you should run today.

What just happened (in one paragraph)

404 Media broke the story on July 1, 2026 that Hide My Email – the iCloud+ feature that generates disposable @icloud.com aliases – had a flaw exposing users’ real email addresses. Apple was told about the bug in June 2025 by Tyler Murphy of EasyOptOuts. Apple told him it was fixed in March 2026. It wasn’t. The patch finally arrived on July 3, 2026, days after the story ran. Researcher testing, per MacRumors’ coverage, showed 100% of Hide My Email addresses were exploitable.

Why “it’s fixed, you’re fine” is the wrong takeaway

Turns out the exploit worked through something you’d never notice: send a targeted Hide My Email user a message that got rejected as spam, and their real address appeared in email transfer logs. No user-facing bounce, no notification, nothing in your spam folder. Murphy and co-founder Ben Weiner told 404 Media that any hidden email address linked to a Hide My Email alias created before July 7, 2026 may have been exposed – and could still be sitting in third-party mail transfer logs.

Apple closed the door. The information that walked out before they closed it is still out there, in log files on mail servers Apple doesn’t control. You can’t audit it. You can’t request its deletion. It just exists.

Watch out: If you used Hide My Email for something where pseudonymity actually mattered – a whistleblower tip line, a dating profile, a burner account for a hostile ex-employer – assume the linkage between that alias and your real address may be recoverable. Rotate now, don’t wait.

The 5-minute audit worth running today

Forget “here’s how to create a Hide My Email address” – every other tutorial covers that. Here’s the workflow the situation actually calls for.

1. Open the list. On iPhone: Settings → [your name] → iCloud → Hide My Email. On the web: icloud.com/icloudplus → Hide My Email. Most people have far more aliases than they remember.
2. Sort by “created before July 2026.” These are the addresses on the vulnerable @icloud.com domain and potentially exposed in third-party logs. Flag anything sensitive: financial services, health portals, anything you signed up for anonymously.
3. Rotate sensitive ones. For each flagged account: log in to the service, change the email on file to a fresh Hide My Email address (which will soon issue on the new private.icloud.com domain), then deactivate the old one. Don’t delete yet.
4. Wait, then delete. You have to deactivate the address before deletion – the delete option only appears in the Inactive Addresses section. Give it 30 days in case a service tries to send a confirmation to the old address.
5. Label everything going forward. The label field is the one Hide My Email feature everyone underuses. Write the service name and creation date. Future-you doing the next audit will thank current-you.

The domain change that makes this messier

According to Apple’s developer announcement, later this summer Sign in with Apple and iCloud+ Hide My Email will unify under private.icloud.com – Sign in with Apple addresses moving from privaterelay.appleid.com, and Hide My Email addresses moving from icloud.com. Existing addresses on legacy domains keep working.

Read that carefully. Old Hide My Email addresses look like [email protected] – indistinguishable from a normal iCloud user. New ones will look like [email protected]. A regex like /@private.icloud.com$/ is enough for any signup form to detect and block them – one line of code, per gblock’s analysis of the domain change.

So here’s the sandwich: your old aliases had a security leak that may persist in logs. Your new aliases will be trivially blockable by any service that wants to reject privacy-conscious signups. Neither is a dealbreaker. Both matter.

A real example: rotating a compromised newsletter signup

Say in 2023 you signed up for a controversial newsletter with a Hide My Email address, specifically so the publisher couldn’t tie it back to your real identity. That alias predates the July 2026 patch.

What you do:

• Log in to the newsletter’s account page. Change email to a newly generated Hide My Email address (which will issue on private.icloud.com once the migration completes).
• Verify the change from your real inbox – the forward still lands there.
• Go back to iCloud settings, find the old alias, tap Deactivate Email Address.
• Two to four weeks later, delete it from Inactive Addresses.

What this does not do: erase the fact that the publisher may already have your real address from a spam-bounce log dating back to 2023. If that specific linkage is dangerous to you, Hide My Email was never the right tool for that threat model. Look at SimpleLogin, addy.io, or a self-hosted catch-all domain where you control the mail server logs.

A few things the community flagged

The Hacker News and MacRumors threads surfaced some sharp points:

• Deleting before deactivating breaks your login. Per Apple’s support documentation (as of July 2026), you must deactivate first – the delete option only appears under Inactive Addresses. Skip that step and you may lose access to accounts still tied to the alias.
• Check your forwarding address. Apple’s support docs confirm you can change it in the Hide My Email management settings. If you’re pointing aliases at a Gmail account you never check, you’ll miss confirmation emails after rotations.
• Hide My Email requires iCloud+, which as of mid-2026 starts at $0.99/month for the 50GB tier. If you’re already paying for iCloud storage, you have it.
• A proposed class action was filed against Apple over what the complaint describes as deceptive privacy claims. Whether it goes anywhere is a different question, but keep receipts if you paid for iCloud+ specifically for this feature.

FAQ

Do I need to do anything if I only used Hide My Email for newsletter spam?

Probably not. The exposure risk matters when linking an alias back to your real identity would actually harm you. For “I don’t want The New York Times knowing my Gmail,” the patch is enough.

How do I know which of my Hide My Email addresses were actually leaked?

You can’t – and that’s the frustrating part. The leak happened on rejected mail that never touched your inbox, so there’s no spam folder to check and no delivery report to pull. Apple hasn’t published a list of affected accounts. Given that testing showed near-universal exploitability, the safe working assumption is that any alias you actively used before July 2026 was potentially exposed at least once. If that’s unacceptable for a specific alias, rotate it. If it’s low-stakes, don’t lose sleep over it.

Is Hide My Email still worth using in 2026?

For spam filtering and inbox hygiene, yes. Convenient, integrated into iOS, no extra app. For genuine pseudonymity? The combination of the historical leak and the coming private.icloud.com domain – which any service can block with one regex – means you should look at SimpleLogin, addy.io, or a self-hosted catch-all if the linkage really can’t be broken.

Your next step: open Settings → iCloud → Hide My Email right now and count how many active aliases you have. If it’s more than ten and you can’t remember what half of them are for, you found your weekend project.