The privacy myth crumbles: Inside the iCloud+ flaws threatening Apple's most valuable promise
Security researchers Talal Haj Bakry and Tommy Mysk reported that Apple’s iCloud+ Private Relay can leak real DNS and IP data, including via WebTransport and passkeys, despite Apple’s claim that no party can see both identity and visited sites. Separately, EasyOptOuts said Hide My Email leaked real addresses for about 12 months; Apple patched July 7. Apple said it is investigating Private Relay.
How this was made
The 30-second read
Why it matters
If confirmed broadly, the disclosures undermine Apple’s privacy positioning and could increase regulatory, litigation, and customer-support costs, while also prompting users to change settings (or disable features) until fixes are verified.
Market read
Traders may reassess Apple’s privacy narrative risk and monitor for follow-up Apple disclosures, regulatory actions, or litigation that could affect sentiment and costs.
What to watch
The article does not quantify affected user counts, exploitability in the wild, or whether the leaks are fully mitigated; those details could materially change the risk assessment.
Background
The article frames two iCloud+ privacy feature failures: Private Relay IP/DNS leaks and Hide My Email real-address exposure, with Apple patches arriving after public reporting.
Ticker impact
Article says iCloud Private Relay can leak real IP via Safari/WebKit issues, and Hide My Email leaked real addresses before Apple’s later patches.
Moderate downside bias for AAPL sentiment until Apple confirms scope, mitigations, and user-impact details.
The piece is centered on Apple’s own privacy features (Private Relay, Hide My Email) and describes systemwide leaks plus delayed patching, which can drive regulatory, litigation, and consumer-trust concerns even without quantified financials.
Market effects
Highlights broader risk that privacy-by-design marketing can fail via OS/browser infrastructure, potentially pressuring other consumer privacy features and browser engines.
US-focused consumer tech sentiment, with potential spillover to EU privacy scrutiny narratives.
Global iOS/WebKit user base and privacy expectations make the findings relevant across major markets, especially where privacy regulators are active.
Counterpoint
Apple may argue the leaks are limited to specific conditions and that patches already address the active exposure, reducing incremental financial impact.
Key entities
- companyApple
Subject of the article, accused of iCloud Private Relay and Hide My Email privacy leaks and delayed patching.
- product_featureiCloud Private Relay
Paid iCloud+ feature marketed to prevent any single party from seeing both identity and visited sites, allegedly leaking real IP/DNS.
- product_featureHide My Email
iCloud+ feature intended to mask real email addresses, allegedly leaking real addresses via bounce/spam rejection logs.
- researcherTalal Haj Bakry
Researcher cited as identifying DNS/IP exposure issues in iOS/WebKit behavior.
- researcherTommy Mysk
Researcher cited as finding additional leaks and attributing issues to systemwide iOS infrastructure.
