Charissa Thompson becomes a victim of the Fappening the second time

On 18th of January, a 35-year-old Fox sports host, Charissa Thompson, confirmed that her private photographs that showed her naked were stolen from the iCloud[1]. After the attack, criminals uploaded the photos on the website which has been previously used to distribute nudes of other Hollywood celebrities as well.

Almost a year later, in December, Charissa's sex video was leaked and placed on the internet for everybody to see. According to reports, It is yet unknown how the data leak occurred, but people can easily find it online.[2] However, there are some speculations that the act of self-love was also leaked through iCloud.

Apple devices automatically upload photographs to the cloud for backup purposes. Even though people can disable this function, many find it useful to avoid data loss. However, by compromising the credentials, cybercriminals can access the information stored in the iCloud[3].

Charissa Thomson is the first victim in the Fappening 2018 scandal (also known as Celebgate). Although, there are over 100 celebrities which were attacked the same way as the well-known sports host, including Jennifer Lawrence, Kate Upton, Kirsten Dunst, Mary Elizabeth Winstead, Miley Cyrus and many others.

Currently, there is no reliable information to confirm particularly how the criminals managed to breach cloud computing services. However, experts believe that they have created fake iCloud login website which looks incredibly similar to the official one. Once the victim enters personal details, they are instantly transferred to the attackers and used to hack into the cloud.

Thompson's attorney has managed to pull out the nudes

Charissa has employed a law firm Lavely & Singer to help her remove the photographs from the sites. Her lawyer, Andrew Brettler points out the following[4]:

We're working with [the Los Angeles District Attorney] hand-in-hand. I think that it's important that the responsible individual or individuals are held accountable for this because it's a disgusting invasion of my client's privacy rights.

Fortunately, he has managed to extract the nudes from the first websites which have posted it. However, C. Thompson aims to track down the cybercriminals and take every appropriate step to seek justice. It is confirmed that the Los Angeles District Attorney's office has received the case for investigation[5].

Photos have been published without our client's authorization, permission, or consent, and in blatant violation of her privacy rights as well as U.S. copyright laws," the lawyer added.

FBI has already caught 4 people responsible for the Fappening attack in 2014

According to the news, FBI has caught four suspects for stealing and releasing private photographs of A-level celebrities. One of them is George Garofano (26) who has already pleaded guilty to unauthorized access to the computer[6]. However, he denies releasing the photos on the Internet.

Other arrested criminals are Ryan Collins (36), Edward Majerczy (29), and Emilio Herrera (32). All of the caught criminals are sentenced from 9 to 18 months in federal prison, or waiting for the sentencing.

Experts say that the attacker was using phishing emails and has collected over 250 credentials to hack into Apple iCloud accounts. The letters were designed to impersonate Apple Security Department to lure people into giving their personal details. Following the breach, G. Garofano has traded the obtained photos, logins, and passwords with others.

Charissa Thompson Fappening 2018 leak at a glance

The 2018 leak of private photos belonging to Fox Sports host Charissa Thompson was an account takeover, not a flaw that anyone has shown in Apple's servers. The best documented earlier case, the 2014 wave of celebrity leaks, was traced to phishing emails that tricked people into handing over their passwords.[9][10] This section adds the dated record, the law and a protection checklist to the report above. It does not describe or link to any private images, and it does not guess about anyone's private life.

Timeline of the Thompson leak and the 2018 wave

The table below lists only dated events that we could match to a news report, a court release or a company statement.

Note the order. The January 2018 plea in a phishing case and the January 2018 leak landed in the same month, but no source we read connects the two. Anyone who claims a link is guessing.

What the law says in the UK

In the UK, getting into someone else's account without permission is already a crime. Section 1 of the Computer Misuse Act 1990 makes unauthorised access to computer material an offence, with a maximum of two years in prison, a fine or both on indictment.[13]

Sharing the pictures is a separate matter. Section 33 of the Criminal Justice and Courts Act 2015 created the offence of disclosing private sexual photographs with intent to cause distress, but Parliament repealed it on January 31, 2024 through the Online Safety Act 2023.[14] Section 188 of that Act inserted new offences into the Sexual Offences Act 2003, in sections 66B to 66D.[15]

• Sharing an intimate photograph or film of a person without their consent, when the sharer does not reasonably believe they consent, is an offence under section 66B.[15]
• Sharing one with the intention of causing alarm, distress or humiliation is covered, and so is sharing for sexual gratification without consent.[15]
• Threatening to share such an image, to make someone fear the threat will be carried out, is also covered.[15]

We did not review how these rules apply in Scotland and Northern Ireland.

What the law says in the United States

US federal law treats the break in and the leak separately. The 2014 hackers were prosecuted under the Computer Fraud and Abuse Act. One of them pleaded guilty to a felony count of unauthorized access to a protected computer to obtain information.[9] The Justice Department release also said the man was not linked to the actual leaks, which shows that a hacker can be held accountable even without selling or posting what was stolen.[9]

Victims also have a civil route. Under 15 U.S.C. 6851, a person whose intimate image is disclosed without consent can sue in federal court, and the court can award actual damages or liquidated damages of $150,000, attorney's fees and an order to stop the disclosure.[16] The person sued must have known, or recklessly disregarded, that there was no consent, and several exceptions apply.[16] Thompson's lawyer also cited copyright law in 2018 statements quoted above.

This is general information, not legal advice. A lawyer who handles privacy cases can tell you which law fits your situation.

How account takeovers like this happen

Apple's own account of the 2014 incident is a useful guide. The company said the celebrity accounts were compromised by a very targeted attack on user names, passwords and security questions, and said the problem was not a breach of iCloud or Find My iPhone.[11] Court papers describe the method. The accused sent emails that looked like messages from Apple or Google security teams and asked victims to share their usernames and passwords.[9][10]

We analyse the pattern as four weak points. They are our reading of the court and company statements, not a finding about Thompson's case.

1. Phishing. A fake sign in page or a fake security email asks for a password. The sender controls the page, so the password goes straight to the attacker.[9][18]
2. Reused or weak passwords. If one site leaks your password, attackers try it on cloud and email accounts. Our breach tracker shows how often that happens.
3. No second factor. With two factor authentication, a stolen password alone is not enough, because sign in also needs a code from a trusted device or phone number.[19]
4. Guessable recovery answers. Apple named security questions among the targets in 2014, which is why answers that can be found online are a risk.[11]

Our guide to two step verification shows how to turn on the second factor, and the checker can tell you if an email address has appeared in a known leak.

Leaks used as bait for malware

Every celebrity leak creates a wave of searches, and criminals use that curiosity. In September 2014, NBC News reported a Symantec alert about scams tied to the stolen photos. Fake texts and emails pretended to come from Apple support, and some links led to a so called video converter that was actually malicious software.[17]

• Do not search for the leaked files. Pages that promise them are a common way to deliver malware or steal logins.[17]
• Never install a viewer, converter or player to open a supposed leak.[17]
• Be suspicious of any message about your own account that arrives after a news event, even if it uses the name of a company you use.[20]
• If you clicked something, update your security software, run a full scan and change your passwords from a clean device.[18]

Our page on running an offline Defender scan covers the cleanup step, and how to report phishing explains where to send the fake message.

Six step account protection checklist

1. Give the account its own long password and keep it in a password manager. A password that appears on no other site cannot be reused against you.

2. Turn on two factor authentication. Apple describes it as an extra layer that keeps the account yours even when someone else knows the password.[19]

3. Treat every security email as unverified. CISA advises against following links in email that ask for personal information, and says to verify a request by contacting the company directly through details you already trust.[20]

4. Review the devices and recovery details on the account. Remove any device you do not recognise and make sure the recovery email and phone number are yours.

5. Decide what really needs to live in the cloud. The FTC recommends backups, and a backup is useful, but old private files you no longer need are better deleted.[18]

6. Know where to report. Send phishing to the sender's provider through our reporting guide, report a crime through the cybercrime guide, and if you gave away money or details, read what to do after paying a scammer. If identity details were exposed, freezing your credit is free in the US.

What is still unknown

• How Thompson's account was accessed. The sources we read report that it was taken from her cloud account, but none shows how.[3][7]
• Who took and posted the files. We found no arrest or charge tied to the 2018 leak.
• Whether the 2018 leak is connected to the 2014 cases. The people charged in 2014 were sentenced before or during 2018, and no source links them to Thompson.[10]
• Whether a later video leak reported in December 2018 came from the same account. The earlier article cites a radio report that says the cause is unknown.[2]

We will update this page if a court record, police statement or Apple statement settles any of these points.

Related reading on 2-Spyware

• How to report phishing if you received a fake Apple or Google message.
• How to report cybercrime to the right agency.
• Data breach news for other account leaks.
• Check an email address against known leaks.