From CNET: A couple of weeks ago, I wrote about a bug in Apple's iCloud Hide My Email tool that appeared to reveal users' real email addresses to anyone who wanted to find them. On Wednesday, a lawsuit was filed in California, Alvarez v. Apple Inc., accusing Apple of false advertising, fraud and breach of contract for selling a privacy perk that it allegedly could not deliver.
The Hide My Email feature, which lets you generate a temporary, anonymized email address with the iCloud.com domain, is often used to protect privacy when signing up for subscriptions or logging into new or unverified websites. The feature is currently available with a paid iCloud Plus subscription.
The lawsuit claims that a known security vulnerability in Hide My Email exposes the true email addresses behind the randomly generated email aliases. The suit says that Apple was made aware of this flaw by a security researcher in June 2025, but left the issue unresolved while continuing to advertise the feature as a secure privacy tool.
The suit, which seeks class action status, requests a jury trial and states that the value of the claims is greater than $5 million. In addition to seeking financial compensation, the suit also requests that Apple fix the Hide My Email vulnerability or disclose its limitations.
View: Full Article
