If a user with the `checkuser` group, but not the `suppressor` group, performs a 'ipusers` CheckUser API request on an IP address which has been used by a user that has been blocked with `hideuser`, then the username of the hidden user will be displayed.
Note: This was an issue before the refactoring done in T341827, and so that ticket has not caused this (in fact it fixed log entries having deleted information displayed).
For example:
| The block entry with `hideuser` set | The user appearing in the results list for a user without the `suppressor` group | The contributions page for that hidden user |
| -- | -- | -- |
| {F43690027} | {F43690557} | {F43689992} |
=======Steps to reproduce
# Block a user with `hideuser` enabled using an account with the `suppressor` group
# Log into an account with just the `checkuser` group
# Open `Special:ApiSandbox` and select `action` as `query` and `list` as `checkuser`
# Provide the check target as an IP address used by the account that was blocked in step 2
# Run the check
# Search for the username of the blocked user