Private Relay Leaks Real IPs, Met Police Reprimanded by the ICO (08/05/2026)

Two failures today in tools people were told to rely on. Apple’s Private Relay is a paid privacy feature that hides your IP address, except when it does not, which is often. And the Metropolitan Police handed a stalking suspect the new address and phone number of the woman who had moved to get away from him. One of these is a bug. The other is what happens when a control exists on paper and nobody checks that a person performed it.

Top 3 Critical Privacy Alerts

1. Private Relay Is Exposing the Addresses It Exists to Hide

A series of issues in Apple’s WebKit engine mean iCloud Private Relay, which is supposed to conceal a user’s IP address from the sites they visit, in many cases does not. WebKit underlies every browser on iOS, so the exposure is not confined to Safari, and it reaches users who are paying for iCloud+ specifically for this protection. TechCrunch

Operator Note: The population most harmed here is the one that sought the feature out: journalists, people with stalkers, anyone whose location is a safety matter rather than a preference. A privacy control that fails quietly is worse than none, because people route real risk through it.

2. The Met Gave a Stalking Suspect His Victim’s New Address

In January 2024 a superintendent authorized an interim Stalking Protection Order against a man arrested for harassment and malicious communications. Despite explicit instructions to redact, officers served him unredacted witness statements containing his victim’s new phone number and home address, along with contact details for her friends and family. Within days she reported that he had contacted her on the new number. He had already fled the UK in breach of bail, was arrested on re-entry in July 2024, and was imprisoned after pleading guilty to stalking. The ICO issued an enforcement notice and a reprimand, and group manager Jo Stones said the incidents were foreseeable and preventable. The Register

Operator Note: She did the one thing the system asks a person in her position to do. She moved, and she trusted the institution with where. The ICO also found a second breach where an officer sent an update to 18 parliamentary honeytrap victims without using BCC, and that officer had not completed data protection training in over four years. Neither had their manager.

3. The ICO Puts the Met on a Twelve-Month Clock

The enforcement notice requires the Metropolitan Police to reach 100 percent data protection training completion, review email practices quarterly where multiple recipients are involved, explore more secure alternatives to email, and report progress to the ICO monthly for twelve months. The Register

Operator Note: Look at what the regulator asked for. Not a new platform, not encryption, not a maturity model. Training completion and a quarterly check on how people send email. The remedy matches the failure, which is worth remembering the next time a control gap gets answered with a purchase order.

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.