DOJ Prosecutions of the 2014 Celebrity Photo-Hack ('Fappening') Phishers

In late August 2014, nearly 500 private, sexually explicit photographs and videos of more than 100 mostly female celebrities were stolen and distributed online, an event the internet labeled 'Celebgate' or 'The Fappening.' The images had been obtained from victims' Apple iCloud accounts and were rapidly redistributed across multiple sites. On Reddit, the dedicated community r/TheFappening became a primary aggregation point, drawing an enormous traffic surge during the roughly one week it operated, a spike Reddit later acknowledged with discomfort.

Reddit removed r/TheFappening on September 6, 2014, several days after the images first spread. The company cited being overwhelmed by DMCA takedown requests from the victims' representatives and noted that some images depicted minors, which violated both Reddit's rules and U.S. law. The episode is now treated as a landmark case of mass non-consensual distribution of intimate imagery, and the lasting harm fell on the victims whose private images were stolen and permanently disseminated.

The criminal investigation, led by the FBI and federal prosecutors, established that the breaches were carried out through targeted phishing rather than any single technical flaw in Apple's systems. Perpetrators sent emails impersonating Apple or Google security teams to trick victims into surrendering account credentials, which were then used to access iCloud backups and download personal photos. Federal authorities pursued charges primarily under the Computer Fraud and Abuse Act.

Four men were charged. Ryan Collins of Lancaster, Pennsylvania, pleaded guilty to unauthorized access to a protected computer and was sentenced in 2016 to 18 months in federal prison, after a campaign that accessed at least 50 iCloud and 72 Gmail accounts, mostly belonging to female celebrities. Edward Majerczyk of Chicago was sentenced in January 2017 to nine months and ordered to pay restitution for a scheme that compromised more than 300 accounts. George Garofano of North Branford, Connecticut, pleaded guilty in April 2018 and, according to the U.S. Department of Justice, was sentenced in August 2018 to eight months in prison plus three years of supervised release and 60 hours of community service, having admitted to phishing more than 200 iCloud accounts. Emilio Herrera of Chicago was also charged in the scheme.

A crucial limitation defined the prosecutions: authorities stated they found no evidence directly linking any of the convicted phishers to the actual posting of the stolen images on 4chan, Reddit or elsewhere. The men were prosecuted for the unauthorized account access that enabled the theft, not for the public distribution that caused much of the harm, and the individuals who first leaked and spread the material were not identified or charged. The case exposed both the vulnerability of cloud-stored personal data to social-engineering attacks and the gap between prosecuting the intrusion and holding distributors accountable. It remains a defining example of large-scale image-based sexual abuse and helped drive later attention to legal protections for victims of non-consensual intimate imagery.