Loading story…
Private photos of more than 100 celebrities, including Jennifer Lawrence and Kate Upton, were stolen from personal accounts and widely distributed online after first appearing on anonymous forums such as 4chan and AnonIB, with some posters seeking bitcoin in exchange for additional material. The leak spread rapidly across social platforms and media sites, prompted FBI involvement, and drew public condemnation and threatened legal action from victims and representatives, who described the disclosures as a severe invasion of privacy. A second wave of stolen images later surfaced, extending the impact to additional public figures including Kim Kardashian, Gabrielle Union, Amber Heard, and Rihanna.
Subsequent U.S. prosecutors said the thefts were not caused by a breach of Apple’s infrastructure but by targeted phishing and account-compromise activity against iCloud and Gmail users. Ryan Collins later pleaded guilty after investigators found he had accessed more than 120 accounts by sending fake Apple- and Google-themed messages, harvesting credentials, and downloading backups and emails that contained sensitive photos. Apple said its review found no compromise of iCloud or Find My iPhone, instead pointing to attacks on usernames, passwords, and security questions, while reporting later highlighted how readily available phishing kits and backup-extraction tools lowered the barrier for the intrusions.
Get the infrastructure and lures behind it.
14 events from the most recent confirmed update back to the earliest known activity.
George Garofano, a Connecticut man tied to the 2014 celebrity photo hacking scandal, was sentenced in federal court to eight months in prison after pleading guilty. Authorities said he used phishing emails disguised as Apple security messages to steal credentials for more than 200 iCloud accounts, followed by supervised release and community service.
Court filings and reporting clarified that the 2014 celebrity photo thefts were driven by social engineering and credential theft rather than a compromise of Apple's infrastructure. The case reinforced Apple's earlier position that iCloud itself had not been breached and prompted renewed guidance on spotting phishing emails.
U.S. prosecutors said Ryan Collins unlawfully accessed at least 50 iCloud accounts and 72 Gmail accounts, compromising more than 120 accounts overall and stealing private photos through phishing emails masquerading as Apple or Google messages. Collins pleaded guilty under the Computer Fraud and Abuse Act and was expected to accept an 18-month sentence.
In June 2015, CNN reported that the FBI had obtained a search warrant and seized computers, phones, and storage media from Emilio Herrera as part of the investigation into the stolen celebrity photos. The action marked a concrete investigative step beyond the earlier general acknowledgment that federal authorities were looking into the case.
Reporting on October 7, 2014 said Nick Hogan, son of wrestler Hulk Hogan, had become the first publicly identified male victim in the celebrity photo leak scandal. The disclosure showed the incident was still expanding with additional victims named after the second wave of leaked images.
On 2014-10-02, attorney Marty Singer sent a letter threatening Google with a $100 million lawsuit, accusing the company of profiting from and failing to promptly remove stolen celebrity photos from its services. The move marked a more specific legal escalation aimed at a major internet platform rather than only condemning the original theft.
A new batch of stolen celebrity images was released less than a month after the first incident, naming additional victims including Kim Kardashian, Gabrielle Union, Amber Heard, and others, along with previously unseen Jennifer Lawrence photos. Several victims and representatives again condemned the leak and said they would contact the FBI or pursue legal action.
Victoria Justice publicly stated that some photos attributed to her were fabricated, while also calling the broader incident a massive invasion of privacy. She said she was pursuing legal action as reporting continued to describe the leak as affecting more than 100 celebrities.
Following an internal investigation, Apple said it found no evidence that iCloud or other Apple systems were compromised. The company attributed the thefts to targeted attacks on usernames, passwords, and security questions, and said it was cooperating with law enforcement.
U.S. federal investigators said they were aware of the alleged computer intrusions and unlawful release of material involving high-profile individuals and began investigating the incident. Reports around the first leak and later victim statements both referenced FBI involvement.
In the aftermath of the leak, online users focused on Bryan Hamade, who used the handle BluntMastermind, after a screenshot appeared to expose identifying details; he denied being the hacker and said he only pretended to have the images for bitcoin. Separately, an anonymous figure calling himself 'Original Guy' claimed on a deep web forum to have assembled images bought from different hackers.
Reporting highlighted a GitHub-hosted Python script that allegedly exploited a weakness in Apple’s Find My iPhone service, allowing repeated password guesses against iCloud-linked accounts without lockout or alerts. Users said the behavior changed shortly afterward, with accounts locking after five failed attempts, suggesting Apple may have quietly mitigated the issue while investigating.
After the first wave surfaced, celebrities and their representatives publicly responded, with some confirming images were authentic, others disputing fakes, and several threatening legal action over the stolen material. Jennifer Lawrence's spokesman called the leak a flagrant violation of privacy.
A large cache of intimate celebrity photos began circulating online after being posted to anonymous boards including 4chan, with some posts offering additional material for bitcoin or PayPal. The leak affected roughly 100 celebrities and quickly spread to other platforms such as Reddit.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
21 references tracked. Mallory keeps watching after this page renders.
apnews.com
Open sourcetheguardian.com
Open sourcetheguardian.com
Open sourceforbes.com
Open sourcesmh.com.au
Open sourcetheverge.com
Open sourcewashingtonpost.com
Open sourcetheguardian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale theft of private celebrity photos and videos was tied to targeted compromises of Apple and Google accounts, with investigators and researchers describing an underground ecosystem that used phishing, social engineering, password-recovery abuse, remote-access malware, and stolen authentication tokens to reach cloud backups. Security reporting at the time said iCloud was a frequent target because automatic backup features could expose not only photos but also messages, address books, deleted files, and broader device-management capabilities once an attacker gained access, while stolen iTunes or other local tokens could also be used to authenticate to iCloud. U.S. prosecutors later charged Pennsylvania man Ryan Collins with illegally accessing more than 100 email accounts between 2012 and 2014 by sending phishing emails that impersonated Apple or Google and harvesting usernames and passwords; in some cases, he then accessed full iCloud backups and obtained nude photos and videos. The Justice Department said investigators found no evidence that Collins distributed the material or was responsible for the public "Celebgate" leaks, which were circulated on sites including 4chan, Reddit, and anon-ib, where the stolen media appeared to move from private trading circles into public release.
Jun 29, 2026
Sony Pictures Entertainment suffered a destructive cyberattack that leaked internal emails and documents, disrupted operations, and intensified after the studio's planned release of *The Interview*, a film depicting the assassination of North Korean leader Kim Jong Un. A group calling itself **Guardians of Peace** claimed responsibility, and US officials publicly attributed the intrusion to North Korea, with FBI Director James Comey later saying the attackers exposed themselves by sending messages through internet infrastructure used exclusively by North Korea. ABC also reported that investigators believed parts of the operation were routed through compromised computers overseas, underscoring the attackers' efforts to obscure their origin. The attribution quickly became contested as private-sector researchers and cyber intelligence firm Norse briefed the FBI on an alternate theory pointing to disgruntled former Sony employees and piracy-linked hackers rather than Pyongyang, while the FBI said it had no credible evidence contradicting its conclusion. The fallout expanded beyond the initial breach when WikiLeaks published more than **170,000 emails** and **30,000 documents** taken in the attack, prompting Sony to denounce the release as trafficking in stolen, private, and privileged material. Separate reporting on the celebrity photo theft involving Jennifer Lawrence and others showed the FBI simultaneously confronting another high-profile case of hacked private content being widely redistributed online, highlighting the broader climate of major entertainment-sector cyber intrusions and privacy violations.
Jun 29, 2026
A series of high-profile cyber incidents disrupted major online platforms, exposed weak security practices, and highlighted the broad impact of both criminal and activist hacking. A global ransomware outbreak later identified as **WannaCry** spread rapidly across organizations before a security researcher slowed it by registering a domain used as a kill switch, while a separate attack briefly knocked major websites offline through distributed denial-of-service activity. In another major case, hackers compromised prominent US Twitter accounts and used them to promote a Bitcoin scam, demonstrating how access to trusted platforms can be weaponized at scale. Other incidents underscored persistent failures in account security and access control. Equifax faced scrutiny after an Argentine employee portal was reportedly protected with the username and password **`admin`**, adding to concerns around the company’s security posture. Apple said some user accounts had been compromised while denying a broader breach of its systems, and the celebrity photo leak known as **“the fappening”** showed how attackers could exploit personal account weaknesses. Separately, US authorities linked Julian Assange to alleged conspiracy with Anonymous-affiliated hackers, activist campaigns targeted recording industry websites, and the Colonial Pipeline ransomware case showed how an intrusion into a critical fuel operator could trigger widespread operational disruption even when attackers later claimed they had not intended such consequences.
Jul 12, 2026