iCloud leaks of celebrity photos
On August 31, 2014, a collection of almost 500 private pictures of various celebrities, mostly women, and with many containing nudity, were posted on the imageboard 4chan, and later disseminated by other users on websites and social networks such as Imgur and Reddit. The images were initially believed to have been obtained via a breach of Apple's cloud services suite iCloud, or a security issue in the iCloud API which allowed them to make unlimited attempts at guessing victims' passwords. However, access was later revealed to have been gained via spear phishing attacks.
The event, which media outlets and Internet users referred to under names such as "The Fappening" (a portmanteau of the words "fap"—a slang term for masturbation—and "the happening") and "Celebgate", was met with a varied reaction from the media and fellow celebrities. Critics felt that the distribution of the images was a major invasion of privacy for their subjects, while some of the allegedly depicted subjects questioned their authenticity. The leak also prompted increased concern from analysts surrounding the privacy and security of cloud computing services such as iCloud—with a particular emphasis on their use to store sensitive, private information.
Procurement and distribution
The images were obtained via the online storage offered by Apple's iCloud platform for automatically backing up photos from iOS devices, such as iPhones. Apple later reported that the victims' iCloud account information was obtained using "a very targeted attack on user names, passwords and security questions", such as phishing and brute-force attack guessing. It was initially believed that the images were obtained using an exploit in the Find My iPhone service. Court documents from 2014 indicated that one user created a fake email account called "appleprivacysecurity" to ask celebrities for security information. The photos were being passed around privately for at least a couple of weeks before their public release on August 31. There are claims that unreleased photos and videos exist. The Daily Mail cited anonymous posters from 4chan and Deadspin who stated that a ring of hackers, traders, and sellers had been operating for months leading up to the mass release.
The hacker responsible for the leak, who described themselves as being a "collector", distributed the leaked images on the image boards 4chan and Anon-IB in exchange for Bitcoin. Ultimately, the images were widely circulated online via other channels, including Imgur and Tumblr. Celebrity gossip blogger Perez Hilton also re-posted some of the photos on his blog, but soon took them down and issued an apology, saying "he had acted in bad taste".
A major center of activity was the link-sharing website Reddit, where a subreddit was created for sharing the photos; in a single day, it amassed over 100,000 followers. Reddit administrators were criticized for allowing this to take place in an alleged violation of their anti-doxing rules. As McKayla Maroney claimed to be under 18 at the time the photos of her were taken, Reddit staff took photos of her down and warned that anyone re-posting them, or underage photos of Liz Lee which had been circulating prior to this incident, would be permanently banned from the site and could be prosecuted for distributing child pornography. On September 7, citing copyright issues, Reddit banned its "TheFappening" subreddit, also saying the workload of dealing with them had become too much. Reddit banned another subreddit named "Fappening" on the same day.
Content and affected celebrities
The original release contained photos and videos of more than 100 individuals that were allegedly obtained from file storage on hacked iCloud accounts, including some the leakers claimed were A-list celebrities. Shortly after the photos were leaked, several affected celebrities issued statements to either confirm or deny the photos' authenticity. Celebrities who have confirmed the photos' authenticity include Jennifer Lawrence (confirmed by her publicist), Kate Upton and her husband Justin Verlander (confirmed by Upton's lawyer), Mary Elizabeth Winstead (confirmed on Twitter), Jessica Brown Findlay (confirmed by spokesman), Kaley Cuoco (confirmed via Instagram), and Kirsten Dunst, who also criticized the iCloud service. Jill Scott confirmed on Twitter that one of the leaked photos was of her while stating that another was fake.
Celebrities who have denied the photos' authenticity include Ariana Grande and Yvonne Strahovski. Olympic gymnast McKayla Maroney initially denied the images' authenticity on Twitter, then later confirmed that the photos were legitimate while also stating she was underage at the time they were taken. Victoria Justice denied that the photos were authentic but later stated on Twitter that she was pursuing legal actions and found the leak to be a massive invasion of not just her privacy, but of the privacy of all the celebrities affected by the leak. Reports in October indicated that Nick Hogan was the first male star to be directly targeted by hackers; however, Hogan denied the pictures' authenticity.
According to security expert Nik Cubrilovic, in addition to the photographs, other personal information such as text messages, calendars, address books, phone call logs and any other data stored on their phones and backed up to the service were also likely stolen.
On September 20, 2014, a second batch of similar private photos of additional celebrities was leaked by hackers. On September 26, 2014, a third batch was also leaked, which was dubbed as "The Fappening 3".
Actress Lena Dunham pleaded on Twitter for people not to view the pictures, saying doing so "violat[es] these women over and over again. It's not okay." Actress Emma Watson condemned not only the release of the photos, but also "the accompanying comments [on social media] that show such a lack of empathy." Actors Seth Rogen and Lucas Neff also spoke out against the hackers and people who posted the pictures. Justin Verlander, then a pitcher for the Detroit Tigers, told the media prior to a game against the Cleveland Indians that he keeps his private life private and would rather focus on the Tigers' race with the Kansas City Royals for the AL Central title than be a distraction to his teammates. Security analysts have stated that the breach could have been prevented through the use of two-factor authentication, while a Forbes writer recommended turning off the iCloud "Photo Stream" feature (which uploads photos taken with an iOS device to iCloud servers automatically) entirely.
The incident has been given many names, including "The Fappening" (a portmanteau of "The Happening" and "fap", an internet slang term for masturbation) and "Celebgate" (a reference to the Watergate scandal). The term "The Fappening" has received criticism from journalists like Radhika Sanghani of The Daily Telegraph and Toyin Owoseje of the International Business Times, who said that the term not only trivialized the leak, but also, according to Sanghani, "[made] light of a very severe situation"; both articles used the term extensively to describe the event, including in the headlines.
In an interview with The Wall Street Journal, Apple CEO Tim Cook stated that in response to the leaks, the company planned to take additional steps to protect the privacy and security of iCloud users in the future. Notifications will be provided whenever data is restored to a device via iCloud and after logging into iCloud via a web browser, in addition to existing notifications when a user's iCloud password is changed. Additionally, Apple will broaden and encourage the use of two-factor authentication in future versions of its software and operating systems, such as the then-upcoming IOS 8. In conclusion, he emphasized that "we want to do everything we can do to protect our customers, because we are as outraged if not more so than they are."
Jennifer Lawrence contacted authorities and her publicist has stated that the authorities will prosecute anyone who posts leaked images of her. Forbes columnist Joseph Steinberg questioned whether the reactions by law enforcement and technology providers indicated that celebrities were being treated differently from ordinary Americans, which, in the case of law enforcement, may be illegal.
On October 1, 2014, Google was threatened with a lawsuit by lawyer Martin Singer for $100 million on behalf of unnamed victims of the leaks, alleging that Google had refused to respond to requests for the images to be removed from its platforms (including Blogger and YouTube), "[failing] to act expeditiously, and responsibly to remove the images", and "knowingly accommodating, facilitating, and perpetuating the unlawful conduct".
In an interview with Vanity Fair, Lawrence called the leak a "sex crime" and a "sexual violation" and added, "anybody who looked at those pictures, you're perpetuating a sexual offense and you should cower with shame". This view was contrasted by another victim of the hack, Emily Ratajkowski, who told GQ, "A lot of people who were victims of [the hack] said anyone who looks at these pictures should feel guilty, but I just don't think that's fair", and "I'm not sure that anyone who Googles it is necessarily a criminal. I think the people who stole the photos are".
The FBI said that it was "aware of the allegations concerning computer intrusions and the unlawful release of material involving high profile individuals, and is addressing the matter." Similarly, Apple stated that it had been investigating whether a security breach of the iCloud service was responsible for the leaked photographs, as per the company's commitment to user privacy. On September 2, 2014, Apple reported that the leaked images were the result of compromised accounts, using "a very targeted attack on user names, passwords and security questions, a practice that has become all too common on the Internet".
In October 2014, FBI searched a house in Chicago and seized several computers, cell phones and storage drives after tracking the source of a hacking attack to an IP address linked to an individual named Emilio Herrera. A related search warrant application mentioned eight victims with initials A.S., C.H., H.S., J.M., O.W., A.K., E.B., and A.H., which supposedly point to stolen photos of Abigail Spencer, Christina Hendricks, Hope Solo, Jennette McCurdy, Olivia Wilde, Anna Kendrick, Emily Browning, and Amber Heard. According to law enforcement officials, Herrera was just one of several people under investigation and the FBI carried out various searches across the country.
In March 2016, 36-year-old Ryan Collins of Lancaster, Pennsylvania agreed to plead guilty to one count of unauthorized access to a protected computer to obtain information resulting in an 18-month sentence. While no victims were named in the court documents, numerous media outlets connected Collins' case to The Fappening. During the investigation, it was found that Collins phished by sending e-mails to the victims that looked like they came from Apple or Google, warning the victims that their accounts might be compromised and asking for their account details. The victims would enter their passwords, and Collins gained access to their accounts, downloading e-mails and iCloud backups. In October 2016, Collins was sentenced to 18 months in prison.
In August 2016, 28-year-old Edward Majerczyk of Chicago, Illinois agreed to plead guilty to a similar phishing scheme, although authorities believe he worked independently and he was not accused of selling the images or posting them online. On January 24, 2017, Majerczyk was sentenced to nine months in prison and was ordered to pay $5,700 in restitution to cover the counseling services of one unnamed celebrity victim.
Emilio Herrera, also from Chicago, had first been named in the press in 2014; he pleaded guilty to one count of unauthorized access to a protected computer to obtain information in October 2017. Herrera had accessed the accounts of unnamed celebrities and others but was not accused of being involved in leaking or sharing the photos and videos he obtained. He was sentenced to 16 months in jail in March 2018.
In April 2018, 26-year-old George Garofano of North Branford, Connecticut pleaded guilty to one count of unauthorized access to a protected computer to obtain information. Garofano's attorney said he had been led into the phishing scheme by criminals. On August 29, 2018, a federal court sentenced Garofano to eight months in prison.
On October 22, 2018, Christopher Brannan, a former Virginia teacher, became the fifth man to be convicted in relation to the hacking. Brannan pled guilty to federal charges of aggravated identity theft and unauthorized access to a protected computer. Through a phishing expedition, he hacked more than 200 people. In addition to his celebrity victims, Brannan targeted his underage sister-in-law, as well as teachers and students at the school where he used to teach. Brannan was sentenced to 34 months in prison on March 1, 2019.
- Criticism of Apple Inc.
- Edison Chen photo scandal
- Imagery of nude celebrities
- List of "-gate" scandals
- Arthur, Charles (September 1, 2014). "Naked celebrity hack: security experts focus on iCloud backup theory". The Guardian. Retrieved September 4, 2014.
- Terrence McCoy (September 2, 2014). "4chan: The 'shock post' site that hosted the private Jennifer Lawrence photos". The Washington Post. Retrieved September 2, 2014.
They quickly spilled to Reddit, where thousands purveyed it under the handle of "the Fappening" — "fap" means to masturbate — before the news reached Buzzfeed and the rest of the viral media gang.
- David McCormack; Paul Chavez; Zoe Szathmary; Sophie Jane Evans (September 2, 2014). "New wave of leaks target more celebrities as authorities prove unable to stop spread as it emerges naked photos may have been passed around online club for MONTHS". The Daily Mail. Retrieved September 2, 2014.
Last night, Reddit users took to a special subsection of the social networking site devoted to the leaks, called Fappening, to discuss the supposed release of a new wave of naked images.
- Landi, Martin (September 2, 2014). "Stars' nude photo attack may have been down to password codes". Irish Independent. Retrieved September 1, 2014.
- Alistair Charlton (January 2, 2015). "iCloud accounts at risk of brute force attack as hacker exploits 'painfully obvious' password flaw".
- "Apple – Press Info – Apple Media Advisory". Apple Inc. September 2, 2014. Retrieved September 2, 2014.
- "Apple denies iCloud breach in celebrity nude photo hack". The Verge. Retrieved September 2, 2014.
- Williams, Owen (September 1, 2014). "This could be the iCloud flaw that led to celebrity photos being leaked". The Next Web. Retrieved September 2, 2014.
- "Tim Cook Says Apple to Add Security Alerts for iCloud Users". The Wall Street Journal. September 5, 2014. Retrieved September 7, 2014.
- Biddle, Sam (2016). "Feds Raided Another Chicago Home in Nude Celeb Hack Investigation, Still No Charges Pressed". Gawker. Archived from the original on January 16, 2016. Retrieved January 27, 2016.
- Sargent, Jordan (September 1, 2014). "Is This 4chan Offshoot the Ground Zero for the Leaked Celebrity Nudes?". Gawker. Archived from the original on September 2, 2014. Retrieved September 2, 2014.
- Alexander, Ella (September 1, 2014). "4Chan nude photo hacker disappointed by lack of money earned from naked celebrity leaks: 'I really didn't get close to what I was hoping'". The Independent.
- "Inside AnonIB, Where Hacking Is a Sport and Women's Bodies Are the Prize". Slate. Retrieved September 7, 2014.
- Selby, Jenn (September 1, 2014). "Perez Hilton apologises for Jennifer Lawrence naked photo leak". The Independent.
- Jaworski, Michelle (September 1, 2014). "Perez Hilton removes 'Celebgate' photos, calling his post a mistake". Daily Dot.
- Dewey, Caitlin (September 5, 2014). "Meet the unashamed 33-year-old who brought the stolen celebrity nudes to the masses". The Washington Post. Retrieved September 12, 2014.
- Woollacott, Emma (September 8, 2014). "Reddit Gives Mixed Messages After Pulling Leaked Celebrity Photos". Forbes. Retrieved September 10, 2014.
- Price, Rob (September 1, 2014). "Reddit's privacy rules fail as celebrity nudes spread like wildfire". Daily Dot.
- Jenni, Ryall (August 31, 2014). "Social Media Goes Wild Over Massive Celebrity Nude Photo Leak". Mashable.
- Finn, Natalie. "McKayla Maroney Hacked Too?! Lawyer Says Gymnast Was Underage When Leaked Photos Were Taken, Gets Porn Site to Remove Nude Images". E! Online. Retrieved September 4, 2014.
- Stephanie Marcus (September 8, 2014). "The Media Has Been Very Hypocritical About The Celebrity Nude Photo Hack, But It's Trying To Change". Huffington Post. Retrieved September 10, 2014.
- "Time to talk : announcements". reddit. Retrieved October 5, 2014.
- Alexander, Ella. "Jessica Brown Findlay: Downton Abbey star is linked to list of celebrities targeted by hackers". Independent. Retrieved September 4, 2014.
- Kedmey, Dan. "Hackers Leak Explicit Photos of More Than 100 Celebrities". TIME. Retrieved September 3, 2014.
- Shrivastava, Anshu (September 1, 2014). "Celebrities' Leaked Nude Photos: Master-List Printed, Selena Gomez, Kim Kardashian, Kate Upton, Jennifer Lawrence, Kaley Cuoco, Rihanna, More Names On It". International Business Times. Archived from the original on September 2, 2014.
- O'Neill, Kara. "Celebrity victims of the nude photos hack: A who's who of the ones you might not have heard of". Mirror.
- l, Hollywood Life Staff. "Tenna Torres: 'American Idol' Semi-Finalist Latest Victim Of Nude Leak". Hollywood Life.
- "Nude Jennifer Lawrence photos leaked by hacker who claims to have 'private pictures of 100 A-listers'". The Daily Telegraph. September 1, 2014. Retrieved September 1, 2014.
- "Justin Verlander, Kate Upton apparent victims of nude photo leak". September 1, 2014. Retrieved September 2, 2014.
- Kalaf, Samer. "Justin Verlander And His Hacked Photos: A Partial Timeline".
- Zarrell, Rachel. "Jennifer Lawrence, Victoria Justice, Others Victims Of More Alleged Leaks, Apple Denies Breach".
- Arthur, Charles (September 1, 2014). "Nude celebrity picture leak looks like phishing or email account hack". The Guardian.
- Selby, Jenn (September 1, 2014). "Mary E. Winstead nude photo leak: 'To those looking at photos I took with my husband, hope you feel great about yourselves'". The Independent. Retrieved September 1, 2014.
- "Amy Duncan: Downton Abbey star Jessica Brown Findlay is latest naked photos victim as her sex tapes emerge online".
- Bryan Durnham (September 2, 2014). "Hacked and leaked: Nude Hollywood". DNA India. Retrieved September 2, 2014.
- "Kaley Cuoco Addresses Nude Photo Leaks With Topless Picture". Yahoo. Retrieved September 4, 2014.
- "Celeb anger at Apple over hacked photos: Kirsten Dunst leads criticism as company 'actively investigates' claims that hundreds of stars' nude images were stolen from iCloud". September 1, 2014. Retrieved September 1, 2014.
- "Kirsten Dunst breaks silence on nude photo leak scandal rocking Hollywood". Independent. Retrieved September 4, 2014.
- Selby, Jenn. "4Chan naked photos leak: Celebrity Twitter reactions to the mass breach of privacy". Independent. Retrieved September 5, 2014.
- "Ariana Grande Denies Authenticity of Alleged Leaked Nude Photos". Billboard. August 31, 2014. Retrieved September 1, 2014.
- McCormick, Rich (September 1, 2014). "Reported iCloud hack leaks hundreds of nude celebrity photos". The Verge.
- Schlossberg, Mallory. "YVONNE STRAHOVSKI'S RESPONSE TO LEAKED NUDES IS POWERFUL — PHOTO". Bustle.
- Boren, Cindy (September 1, 2014). "Olympic gymnast McKayla Maroney says leaked racy photos are fake, fends off Twitter backlash". The Washington Post. Retrieved September 3, 2014.
- @McKaylaMaroney (September 3, 2014). "the fake photos of me are crazy!!
was trying to rise above it all, and not give "the creator" the time of day.. BUT." (Tweet) – via Twitter.
- Alexander, Ella. "Victoria Justice 'angry' at 'massive invasion of privacy' after naked photos leak online". Independent. Retrieved September 4, 2014.
- Denham, Jess. "The Fappening 4 naked photo leaked: Hulk Hogan's son Nick Hogan becomes first male victim". Independent. Retrieved October 5, 2014.
- Grubb, Ben (September 3, 2014). "iCloud celebrity photo hack: texts, address books and more 'also accessible'". The Sydney Morning Herald. Retrieved September 4, 2014.
- "Notes on the Celebrity Data Theft". Archived from the original on October 6, 2014. Retrieved October 5, 2014.
- "Business Insider: Here's How Hacked Celebrities Are Responding To The Latest Round Of Nude Photos". Business Insider. September 22, 2014. Retrieved October 5, 2014.
- "The Fappening 3: More Nude Photos Of Stars Leak Online — Cara Delevingne & More – Hollywood Life". Hollywood Life. September 28, 2014. Retrieved October 5, 2014.
- "The Fappening 3 – Jennifer Lawrence Nude Photos Leaked". The Hacking Post – Latest hacking News & Security Updates. Retrieved October 28, 2014.
- Clark, Cindy (September 1, 2014). "Lena Dunham asks people not to look at leaked nude photos". USA Today. Retrieved September 2, 2014.
- "Emma Watson on Jennifer Lawrence naked photo leak: 'Even worse than seeing women's privacy violated is reading the comments'". The Independent. September 2, 2014. Retrieved September 2, 2014.
- Lubitz, Rachel (September 1, 2014). "More stars react to the massive celebrity-photo leak". The Washington Post. Retrieved September 2, 2014.
- Justin Verlander addresses scandal ESPN.com (September 2, 2014)
- Hesseldahl, Arik (September 1, 2014). "Apple Says It Is "Actively Investigating" Celeb Photo Hack". Re/code. Retrieved September 2, 2014.
- Kelly, Gordon (January 9, 2014). "Staying Safe And How To Disable Apple iCloud". Retrieved September 2, 2014.
- Volkert, Zachary (September 1, 2014). "The Fappening — Are Naked Jennifer Lawrence Photos Worse For Apple or Feminism?". The Inquisitr.
- Alfonso III, Fernando (August 30, 2014). "Hundreds of alleged celebrity nudes leak on the seediest corners of the Web". Daily Dot.
- Owoseje, Toyin. "A New Kind of Pervert? 'The Fappening' Proves Revenge Porn Culture is Thriving". IB Times. Retrieved September 5, 2014.
- Radhika Sanghani (September 2, 2014). "Jennifer Lawrence photo leak: Let's stop calling this hacking 'The Fappening'". The Telegraph. Retrieved September 2, 2014.
- Wakabayashi, Daisuke (September 5, 2014). "Tim Cook Says Apple to Add Security Alerts for iCloud Users". Wall Street Journal.
- "Apple just added another layer of iCloud security, a day before iPhone 6 event". The Verge. September 8, 2014. Retrieved September 8, 2014.
- "Jennifer Lawrence requests investigation after nude pics leaked online by hacker". Fox News Channel. Associated Press. September 1, 2014. Retrieved September 1, 2014.
- Steinberg, Joseph (August 31, 2014). "Nude Photos Of Jennifer Lawrence And Kate Upton Leak: Five Important Lessons For All of Us". Forbes. Retrieved September 2, 2014.
- "Google Blasted With $100M Lawsuit Threat Over Hacked Celeb Photos". Deadline Hollywood. Retrieved October 2, 2014.
- "Google threatened with $100m lawsuit over nude celebrity photos". The Guardian. Retrieved October 2, 2014.
- "Cover Exclusive: Jennifer Lawrence Calls Photo Hacking a "Sex Crime"". Vanity Fair. October 8, 2014. Retrieved October 11, 2014.
- "Emily Ratajkowski On Nude Photo Leak: 'People Who Google My Photos Are Not Criminals' : The Eye". Fashion & Style. August 4, 2015. Archived from the original on December 27, 2015. Retrieved December 23, 2015.
- "FBI "addressing" leak of celebrities' nude photos". CBS News. September 1, 2014. Retrieved September 2, 2014.
- "Apple statement on celebrity hacking: our systems weren't breached". Business Insider. September 2, 2014.
- Diamond, Jeremy. "FBI seized tech from home linked to celebrity hack". CNN. Retrieved August 14, 2015.
- Otis, Ginger. "FBI pinpoints Chicago home, suspect in 2014 'Celebgate' nude photo leak". New York Daily News. Retrieved August 14, 2015.
- Drury, Flora. "FBI investigation into leaked naked celebrity photos focuses on man who 'lives alone with parents' as they say many more famous people may have been hacked". Dailymail. Retrieved August 14, 2015.
- Blankstein, Andrew (March 15, 2016). "Pennsylvania Man Is Charged in Celebrity Hack, Reaches Plea Deal". NBC News. Retrieved March 15, 2016.
- Prosecutors find that ‘Fappening’ celebrity nudes leak was not Apple’s fault March 15, 2016, Techcrunch
- Hacker who stole nude photos of celebrities gets 18 months in prison October 27, 2016, The Guardian
- "Celebgate hack: Collins sentenced over nude photos theft". October 28, 2016 – via www.bbc.com.
- Meisner, Jason (August 31, 2016). "Chicago man to plead guilty in Jennifer Lawrence celebrity nude photo hack". Chicago Tribune. Retrieved September 1, 2016.
- Meisner, Jason (January 24, 2017). "Chicagoan gets prison for 'Celebgate' nude-photo hacking that judge calls 'abhorrent'". Chicago Tribune. Retrieved January 24, 2017.
- Kelly, Ray (October 23, 2017). "Man faces 5 years in prison after hacking into 40 celebrity accounts and hundreds of others". Los Angeles Times. Retrieved May 17, 2018.
- Tchekmedyian, Alene (April 13, 2018). "Connecticut man pleads guilty to hacking Jennifer Lawrence, celebrity accounts for nude photos". Mass Live. Retrieved May 17, 2018.
- "Hacker of celebrity photos gets 8 months in prison". ABC News. Archived from the original on August 31, 2018.
- Burns, Jake (October 22, 2018). "Ex Hanover special ed teacher pleads guilty in "Celebgate" hacking scandal". WTVR-TV. Retrieved November 17, 2018.
- "Former Hanover teacher sentenced in 'Celebgate' nude photo hacking". WTVR-TV. March 1, 2019. Retrieved March 24, 2019.
- Hacked Celebrity iCloud Accounts – Technical analysis of security breach
- Full list of celebrities allegedly affected by nude photo leak at Variety Latino (Archived August 18, 2017, at the Wayback Machine)