# Apple Reveals Real iCloud Address to FBI via Hide My Email Request
Apple handed over the real iCloud address hidden behind an anonymous alias from the Hide My Email service to the FBI. This happened as part of an investigation into threats against Alexis Wilkins, who is connected to FBI Director Kash Patel. Court documents confirm: the company disclosed the link between the random address and the user's main account.
The Hide My Email service, available to iCloud+ subscribers, generates unique random addresses that forward mail to the primary inbox. Users rely on it for signing up on websites, subscriptions, and forms without revealing their real email. However, in this case, anonymity didn't protect against law enforcement.
Details of the Court Case and Data Disclosure
On February 28, 2026, Wilkins received an email from [email protected]. The FBI requested metadata from Apple. The company provided details: the address was tied to Alden Rumel's account. That account had generated 134 anonymous emails.
- FBI Request: Metadata of the anonymous address and its link to the main account.
- Apple's Response: Confirmation of the owner, list of all 134 generated addresses.
- Interrogation: Rumel admitted to sending the email after reading an article about security measures for Wilkins (New York Times, February 28, 2026).
Rumel explained his motive: irritation over a publication about how the FBI deployed resources to protect Patel's girlfriend, including transportation to events.
How Hide My Email Works in Practice
The feature is integrated into iOS, macOS, and the iCloud web interface. When activated:
- A random @icloud.com domain is generated (e.g., [email protected]).
- Incoming mail is forwarded to the user's primary address.
- Outgoing emails are sent from the anonymous address.
- Users manage forwards in iCloud settings.
Despite claims of privacy protection, Apple complies with court orders. Documents show that metadata (including IP addresses, timestamps, and account links) is stored and accessible upon request.
Parallel with Requests to OpenAI
In 2025, the U.S. Department of Justice for the first time compelled OpenAI to hand over ChatGPT user data in a case involving a darknet site with child exploitation. The request included:
- Full conversation logs.
- Names, addresses, and payment details of associated accounts.
- Session metadata.
This sets a precedent for AI services, similar to the Apple case. Developers must consider that end-to-end encryption doesn't always cover account metadata.
Key Takeaways
- Hide My Email masks your email but doesn't protect metadata from court orders.
- Apple stores links between anonymous addresses and the main account (up to hundreds per account).
- The precedent heightens risks for users of cloud services in investigations.
- Similar requests now target AI platforms like ChatGPT.
- Recommendation: Minimize personal data in cloud services.
Implications for Developers and Privacy
For mid/senior-level developers, the incident highlights vulnerabilities in cloud privacy features. Metadata is the weak link:
| Aspect | Hide My Email | ChatGPT Data |
|---------------------|---------------------|--------------------|
| Stored Metadata | IP, timestamps, account links | Session logs, payments |
| Access by Warrant | Full (134 addresses)| Full (all chats) |
| Encryption | Email content only | No E2E for metadata|
When designing similar features (e.g., in custom auth systems), factor in compliance with laws like the CLOUD Act. Test for forensic request scenarios: Do you store forward mappings? Log token generation?
— Editorial Team
No comments yet.