Mikaela Hoover's nude photos leaked in Fappening 2018

Almost four years after the scandal known as the Fappening[1] or Celebgate was registered for the first time, hackers keep hacking celebrities' iCloud accounts and spread their nude photos all around the world. Last week, Mikaela Hoover became the second victim of the Fappening 2018.

A 33-years-old actress, best known for playing Nova Prime's assistant in Guardians of the Galaxy, has contacted the LAPD[2] already and reported a cyber crime against her, causing the loss of nearly 40,000 private photos and videos, in some of which she is captured nude. According to a report from TMZ,[3] 119 of Hoover's nudes were uploaded to the Fappening website.

Nevertheless, Hoover hasn't talked about a new wave of the Fappening that touched her personally, but, based on the news that police is under investigation, the alarm seems to be true.

Hackers do not intend to stop

Although four hackers responsible for the first two massive Fappening waves between 2014 and 2017 have been arrested, their partners keep attacking celebrities in 2018.

The first instance of the iCloud hack was registered in 2014 with the Oscar-winning Jennifer Lawrence as the most prominent victim of the scandal so far.

Hackers stopped for a while and returned in 2017 leaking personal pictures of such celebrities as Kate Upton, Miley Cyrus, Amanda Seyfried, Kristen Stewart, Dakota Johnson, Faye Brookes, Nicole Scherzinger, Maria Kanellis, Anne Hathaway, Charissa Thompson, and a newly hacked Mikaela Hoover. Most of their nude pictures leaked to sharing site 4chan,[4] Reddit, Twitter, and other media sources.

iCloud accounts remain vulnerable

Since the Fappening scandal is not a phenomenon, experts do not expatiate on the hack itself. Nonetheless, we feel the need to remind that Fappening is a scandal related to iCloud accounts. By initiating target phishing attacks, hackers manage to break into iCloud accounts and leak every piece of information stored on it.

Experts point out that in most of the cases hackers obtain the nude pictures of celebrities from Apple devices with the automatic backup function enabled. Although people can disable this feature, for the sake of data loss, most of Apple users keep iCloud service enabled by default.

FBI has already confirmed that four suspects[5] for breaking into celebrities' iCloud accounts and leaking their private photos have been arrested. All of them were sentenced from 9 to 18-months imprisonment, but that did not stop their campaigners to keep iCloud's hacks.

Protect yourself from iCloud's hack

Although hundred percent protection from Fappening hasn't yet been found, experts warn that most of the credentials to access Apple iCloud accounts were gather by initiating phishing campaigns. Potential victims received phishing emails impersonating Apple Security Department and urging people to identify themselves by entering personal details.

Keeping such strategies in mind, it's crucial to check email letters carefully. Although Apple Security Department may send confirmation requests to the Apple device users, such messages will never contain grammar or typo mistakes. Besides, they are sent to confirm the login from another device to the same account, so if you haven't logged to your account using the alternative device, report the message as spam. Having reliable anti-spyware is also a good idea.

Mikaela Hoover leak at a glance

This section adds what the press, police statements and court records have published since the first report. It describes no images and links to none. The case is a theft of private files from a cloud account, and the person to protect is the account owner.

Fappening 2018 timeline

The dates below come from United States Department of Justice press releases, news reports and the original sources of this article. The 2018 leaks and the earlier court cases are separate events, and the pages we read do not link the convicted men to Hoover's leak.

What the court cases show about how these thefts work

Four men were charged or convicted in the Justice Department's Celebgate investigation, which concerns the 2014 leak. Their cases are the best public record of how iCloud accounts were taken, so they explain the method even though none of them is tied to Hoover.

The judge in the Majerczyk case called the crime abhorrent, according to the Justice Department.[9] Sentences were short next to the five year maximum.[10] They did not end the leaks. The 2018 reports show that new victims kept appearing while the first cases were still in court.[6][7]

What the law says in the UK and the US

This is a plain summary of the texts we read and is not legal advice. Two kinds of offences matter: breaking into an account, and sharing private images without consent. The UK and the US treat both as crimes.

Platforms had to be ready to receive removal requests by May 19, 2026, and the Federal Trade Commission enforces that duty. It runs TakeItDown.ftc.gov, where people can complain about a platform that ignored a valid request.[20] In 2018 these tools did not exist in this form. We did not assess which law applied to the 2018 leaks.

How iCloud and other cloud accounts get taken over

The court records point to one method above all: phishing. The reports on Hoover do not say how her account was entered, so the list below describes the usual routes and not her case.[3][6]

• Phishing emails. In all four cases the men sent emails that looked like security messages from Apple, Google or an internet provider and asked for a username and password.[8][9][10][12]
• Fake sign in pages. Majerczyk's emails pointed to a website that collected whatever victims typed in.[9]
• Reused passwords. The UK National Cyber Security Centre says that if you reuse a password and one account is compromised, an attacker can try the same password on your other accounts.[15]
• No second step at sign in. Apple says two-factor authentication makes sure you are the only person who can get into your account even if someone else knows your password.[14] The NCSC calls two-step verification the most important first step if a password is phished.[15]
• Full backups. Collins used a software program to download the whole contents of victims' iCloud backups, which shows why a stolen password can expose years of files at once.[8]
• Trading access. Garofano traded passwords and stolen material with other people, so one phished account can reach several hands.[12]

The FTC lists common signs of a phishing message: a claim of suspicious activity or a problem with your account, a request to confirm personal information, and a generic greeting.[16] Those are the same tricks the court records describe.

How criminals use celebrity leaks as malware bait

Each new leak brings a second wave of scams from people who never touched the original files. Malwarebytes documented one in March 2017, when links promising leaked material for a wrestler led to a Twitter app request and a survey page.[21]

• Close to 300 bait posts appeared in 24 hours, and one shortened link was clicked close to 7,000 times.[21]
• The link asked people to accept a Twitter app. Once installed, the app posted more bait from the victim's own account.[21]
• The next pages asked for an email address to win a gift card, which handed the address to marketers.[21]
• Malwarebytes said the visitor was not guaranteed to get any pictures at all, and it urged readers to leave the leak alone.[21]

This is our analysis: a fresh name in the news, such as Hoover's in February 2018, is the kind of search term this bait feeds on. A page that says you must install an app, an extension or a download before you can see anything is the threat, whatever it promises. Check any link first with our website safety checker. The same warning is in our guide to celebrity leak malware lures.

Protect your cloud account: six steps

1. Turn on two-factor authentication. Apple describes it as a password plus a six-digit code shown on a trusted device or sent to a trusted phone number.[14] Apple also says that most accounts already use it, so check that yours does and that your trusted phone number is current.

2. Use a different password for every account. The NCSC advises against reusing passwords, above all for email, banking, shopping and social media, and recommends a password manager so you do not have to remember them.[15]

3. Never respond to an account alert from an email. Do not click the link, even if it looks like Apple or Google. Open the official app or type the address yourself, and check whether the alert is real there. The FTC says to forward phishing emails to reportphishing@apwg.org and report them at ReportFraud.ftc.gov.[16]

4. Review which devices and phone numbers are trusted. Two-factor codes go to those places, so remove any device you no longer own or do not recognize. This step is our advice, built on how Apple describes trusted devices.[14]

5. Secure your email account first. Email is the key to every reset link, so give it the strongest password and two-step verification. The NCSC puts email at the top of its list of important accounts.[15]

6. Know where to report before you need to. Report phishing through our guide to reporting phishing and crime through our guide to reporting cybercrime. If a platform will not remove private images, use TakeItDown.ftc.gov in the US.[20] If someone has also taken money or card details, see what to do after paying a scammer.

If private images of you were shared or threatened

Keep screenshots of the posts, the account names and the dates, and do not reply to anyone who threatens you. Report the posts to each platform, which in the US must remove reported intimate images within 48 hours once the law applies to them.[19][20] In the UK, threatening to share an intimate image is itself an offence.[18] Then report the theft to the police, as Hoover did with the LAPD.[3] If your credit or identity data was also exposed, a credit freeze is free and worth a look, and our data breaches hub lists confirmed incidents.

What is still unknown

• Who took the files from Hoover's account and whether anyone was charged. No page we read names a suspect.[3][6]
• How the account was entered. TMZ and Newsweek report the theft and the police inquiry, not the method.[3][6]
• Whether the 2018 leaks are linked to the men in the Celebgate cases. We found no source that connects them.
• The exact count of images posted. TMZ and Newsweek say 119, while IBTimes says more than 110.[3][6][7]
• Herrera's sentence. The pages we read stop at his charge and plea agreement.[10]
• Whether the original article's claim of four hackers each serving 9 to 18 months matches every case. The Justice Department pages show 18, 9 and 8 months for three of them, and we found no sentence for Herrera.[8][9][10][13]

We will update this article if police or a court publish more. It was last checked on October 6, 2026.