If a user with the `checkuser` group, but not the `suppressor` group, uses `Special:Investigate` to check an IP address which has been used by a user that has been blocked with `hideuser`, then the username of the hidden user will be displayed in all the tabs on the page.
For example:
| The block entry with `hideuser` set | Leak on the 'Account information' tab | Leak on the 'IPs and User agents' tab | Leak on the 'Timeline' tab | The contributions page for that hidden user |
| -- | -- | -- |
| {F43690027} | {F43691057} | {F43691111} | {F43691130} | {F43689992} |
=======Steps to reproduce
# Block a user with `hideuser` enabled using an account with the `suppressor` group
# Log into an account with just the `checkuser` group
# Open `Special:Investigate` and run a check on an IP address used by the account that was blocked in step 2
# Search for the username of the blocked user in any of the tabs presented