CupertinoApple knew for a year before it patched the bug.
Hide My Email exists so users never share a real address; researchers found 100% of test addresses exploitable via bounced spam emails.
Apple patched it July 3, weeks after 404 Media’s report — not after the researcher’s original 2025 disclosure.
Sources: 404 Media