Apple knew for a year before it patched the bug.

Hide My Email exists so users never share a real address; researchers found 100% of test addresses exploitable via bounced spam emails.

Apple patched it July 3, weeks after 404 Media’s report — not after the researcher’s original 2025 disclosure.

Sources: 404 Media