Loading story…
A large-scale theft of private celebrity photos and videos was tied to targeted compromises of Apple and Google accounts, with investigators and researchers describing an underground ecosystem that used phishing, social engineering, password-recovery abuse, remote-access malware, and stolen authentication tokens to reach cloud backups. Security reporting at the time said iCloud was a frequent target because automatic backup features could expose not only photos but also messages, address books, deleted files, and broader device-management capabilities once an attacker gained access, while stolen iTunes or other local tokens could also be used to authenticate to iCloud.
U.S. prosecutors later charged Pennsylvania man Ryan Collins with illegally accessing more than 100 email accounts between 2012 and 2014 by sending phishing emails that impersonated Apple or Google and harvesting usernames and passwords; in some cases, he then accessed full iCloud backups and obtained nude photos and videos. The Justice Department said investigators found no evidence that Collins distributed the material or was responsible for the public "Celebgate" leaks, which were circulated on sites including 4chan, Reddit, and anon-ib, where the stolen media appeared to move from private trading circles into public release.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Ryan Collins conducted a phishing scheme that illegally accessed more than 100 Apple and Google email accounts, many belonging to entertainment industry members. According to prosecutors, the campaign ran from November 2012 to early September 2014 and was used to obtain credentials and, in some cases, entire iCloud backups.
The U.S. Department of Justice announced charges against Ryan Collins for felony computer hacking tied to unauthorized access to more than 100 Apple and Google accounts. Prosecutors said investigators found no evidence that Collins was responsible for the September 2014 public leaks or that he shared the stolen material.
Apple stated that the incidents resulted from targeted attacks on usernames, passwords, and security questions rather than any breach of Apple systems. A later report also noted Apple had confirmed only that certain celebrities' accounts were compromised, not that 100 iCloud accounts were affected.
Security analysis published after the leak said attackers primarily relied on social engineering, phishing, password recovery abuse, RATs, and stolen authentication tokens rather than the widely discussed iBrute Find My iPhone brute-force technique. The analysis also said compromised cloud backups could expose far more than photos, including messages and deleted files.
Private celebrity photos and videos stolen from cloud-based backup services were distributed publicly on anon-ib, 4chan, and Reddit. Reporting described the leak as the visible portion of a broader underground trading ecosystem for stolen media.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Private photos of more than 100 celebrities, including Jennifer Lawrence and Kate Upton, were stolen from personal accounts and widely distributed online after first appearing on anonymous forums such as 4chan and AnonIB, with some posters seeking bitcoin in exchange for additional material. The leak spread rapidly across social platforms and media sites, prompted FBI involvement, and drew public condemnation and threatened legal action from victims and representatives, who described the disclosures as a severe invasion of privacy. A second wave of stolen images later surfaced, extending the impact to additional public figures including Kim Kardashian, Gabrielle Union, Amber Heard, and Rihanna. Subsequent U.S. prosecutors said the thefts were not caused by a breach of Apple’s infrastructure but by targeted phishing and account-compromise activity against iCloud and Gmail users. Ryan Collins later pleaded guilty after investigators found he had accessed more than 120 accounts by sending fake Apple- and Google-themed messages, harvesting credentials, and downloading backups and emails that contained sensitive photos. Apple said its review found no compromise of `iCloud` or `Find My iPhone`, instead pointing to attacks on usernames, passwords, and security questions, while reporting later highlighted how readily available phishing kits and backup-extraction tools lowered the barrier for the intrusions.
Jun 29, 2026
U.S. prosecutors charged **Kwamaine Jerell Ford**, a 34-year-old Georgia man, with running a long-term social-engineering and account-takeover scheme that targeted **NBA and NFL players** by stealing their **Apple/iCloud credentials** and, in some cases, **multifactor authentication codes**. According to the indictment described by multiple reports, Ford allegedly impersonated a well-known adult film actress on social media to lure athletes into sharing access to their accounts, then used stolen financial and personal data to conduct unauthorized purchases and other fraud. Authorities say the activity ran from **November 2020 through September 2024**, involved more than **2,000 unauthorized transactions**, and led to charges including wire fraud, computer fraud, access device fraud, aggravated identity theft, and sex trafficking; Ford has pleaded **not guilty** and is being held without bail. The case is notable because prosecutors say Ford resumed similar criminal activity while still serving a sentence for an earlier phishing campaign that had also targeted athletes and celebrities. One report says evidence from seized devices showed he began phishing professional athletes again within days of being released to home confinement during the pandemic, while another says some of the alleged conduct occurred while he was still in federal prison. Prosecutors also allege the scheme escalated beyond financial theft: Ford is accused of coercing a woman into sexual encounters with several players, recording hidden videos, and hacking at least one victim's home security cameras. The reporting consistently portrays the operation as a repeat-offender **credential theft and fraud campaign** centered on compromised Apple accounts and social-engineering of high-profile sports figures.
Jun 29, 2026
Researchers exposed **AnonyMousKIT**, an AI-enabled phishing-as-a-service platform designed to harvest Apple ID credentials from victims of recent Apple device theft and use those credentials to disable **Activation Lock** on stolen iPhones and other Apple hardware. The operation automated phishing across email, SMS, WhatsApp, recorded voice messages, and AI-generated voice calls, including Apple-themed social engineering personas such as **"Alice from Apple Support"** to collect victim identity details and account access needed to compromise devices and associated cloud data. Analysis of leaked backend logs tied the activity to a broader reseller ecosystem spanning **506 domains**, **168 storefront brands**, and at least **30 backend installations** active since early 2024, with multiple storefronts linked to a shared codebase and likely common developer. Researchers said coding flaws exposed operator activity and infrastructure, showing a mature supply chain behind the service and underscoring the wider enterprise risk: stolen Apple IDs can provide access not only to hardware but also to **iCloud backups**, **Keychain credentials**, and potentially sensitive work-related information.
Sep 4, 2026