Apple Sued Again! 'Hide My Email' Feature Exposed with Security Flaw Affecting Millions of iCloud+ Users

Apple (AAPL-US) is facing a new consumer class-action lawsuit, with plaintiffs alleging that the company's 'Hide My Email' feature contains a critical security vulnerability, failing to protect users' real email addresses as advertised. The lawsuit further claims that Apple was aware of the issue as early as last summer but failed to take sufficient action to fix it.

According to Fox News, the lawsuit was filed on the 15th in federal court by Anthony Alvarez, a consumer residing in San Diego, California.

Alvarez claims to be one of the 'millions' of users who subscribe to the paid iCloud+ service, expecting it to protect their personal email addresses from exposure.

Apple introduced the 'Hide My Email' feature in 2019, allowing users to register for websites or apps using 'Sign in with Apple' by replacing their real email address with a randomly generated anonymous one. Paid iCloud+ subscribers can generate private relay email addresses more broadly.

Apple's official description states that the feature creates 'unique, random email addresses' and forwards emails to the user's actual inbox, thereby keeping the real email address 'private'.

However, the complaint alleges that the implementation of the 'Hide My Email' feature contains a flaw, allowing nearly anyone without special permissions or internal access to map the generated alias email addresses back to the user's real email address.

Independent testing reportedly found that '100% of the alias email addresses tested were exploitable.'

According to the complaint, a security researcher discovered the vulnerability in June 2025 and reported it to Apple, which acknowledged the issue a month later.

By March this year, Apple claimed it had 'resolved the reported issue through recent system changes.' However, the researcher later reported that the vulnerability still existed, and Apple promised in May to release a patch within weeks. The complaint states this promise was never fulfilled, leading the researcher to eventually disclose the vulnerability publicly.

The report notes that if the judge determines this alleged security flaw affected thousands or even millions of users, the case could proceed as a class-action lawsuit.

The lawsuit does not seek a specific monetary amount but aims to secure damages for consumers who paid for Apple's privacy protection services, which allegedly failed to function as advertised.