The Fappening 2018 continues: Blac Chyna sex tape was leaked

Blac Chyna, whose real name is Angela Renée White, ended up in a compromising situation a couple of days ago. Her sex tape was published on Twitter. Police are currently investigating the issue in order to find out who is responsible for the leak.[1]

It's still unknown whether the personal video was stolen during the iCould leak or it's a "revenge porn," as the lawyers assume. However, the truth whether it was a job of cyber criminals or not will be revealed only after the investigation.

Meanwhile, it was assumed that Chyna's ex-boyfriend Mechie[2] or the celebrity herself might have leaked the video. However, both Mechie and Chyna declines these assumptions. It is reported that the sex tape was taken last summer with woman's phone and no one else has access to the video apart her.

However, she did not report about stolen or hacked phone. Additionally, any other photographies or videos were leaked. Thus, how private video became public remains a mystery. Nevertheless, the uploaded video was removed; its copies might be continued spreading online. Such activities are nearly impossible to stop.

The list of the Fappening victims continues growing in 2018

The Fappening saga,[3] or Celebgate, started in 2014 when a celebrity iCloud hack occurred. Back then, hundreds of private celebrities and actors photos were leaked and published online. Thus, Blac Chyna might be one of the latest victims.

Earlier this year, sports host Carissa Thompson confirmed about her nudes were stolen during Could hack. Another victim was actress Faye Brookes who plays a role in the soap opera "Coronation Street." Her phone was hacked a couple of times, and law enforcement already started the investigation.

One of the latest victims of the fappening 2018 was Mikaela Hoover, [4]the actress from "Guardians of the Galaxy." She lost about 40.000 private pictures and videos; more than a hundred were posted online. Unfortunately, some of them included nudes.

During the past couple of years, around hundred of celebrities suffered from a private photo or video leak, including Anne Hathaway, Miley Cyrus, Kendal Jenner, and many more. Despite the fact that four people were arrested for the first Fappening cases, these attacks towards actresses, singers, and other popular women continue.

Anyone can get their private photos or videos leaked

The Fappening seems to be a problem of the famous people. However, hackers can steal pictures and videos stored on iCloud[5] or other cloud storages from anyone. Data breaches are growing, and criminals can post anyone's photos online or even blackmail into paying the money to keep them unpublished.

• Security specialists recommend following these security tips in order not to get your private pictures leaked:
• secure iCloud, Google pictures or other cloud storage account with a strong password;
• set strong and unique passwords for all your social media, email and other accounts;
• do not use the same password for different accounts;
• be careful with the content you share online, meaning do not post any "too personal" pictures or videos that can be copied and used against you;
• do not share personal or delicate content if you are not hundred percent sure if you can trust them;
• update security software, programs and operating system of your devices to avoid hacks.

Blac Chyna Fappening 2018 leak at a glance

A private video of Blac Chyna was posted from an anonymous Twitter account on February 19, 2018, and nobody has shown how it left her control.[1][2] The old text above covers the first reports. This update adds a dated timeline, the law in the UK and the US, how accounts really get taken over, and a six step checklist you can finish in about twenty minutes. It is written for anyone who stores private photos or videos on a phone or in the cloud, famous or not.

Timeline of the incident and the 2018 Fappening wave

The table lists what the sources let us date. We left out rumours and anything we could not tie to a named page.

What the reports confirm about the February 2018 video

Two quality outlets reported the story within hours. The New York Daily News said a short video appeared on an anonymous Twitter account on Monday and that her representative told the paper she would file a police report.[1] People reported the same day that the video began circulating that morning and that her lawyer publicly condemned the posting.[2]

We do not describe the clip and we do not link to it. That choice is deliberate. Describing or linking to such material helps it spread, and the person in it did not agree to any of that.

• Confirmed by the reports: the date, the platform, the anonymous account, the police plan and the lawyer's statement.[1][2]
• Reported but unverified: the claim relayed by People that the clip was recorded last July on her phone, and the denial from a representative of her former partner.[2]
• Not shown by any report: that her phone, her cloud account or her email was hacked. The old article above says the same.

This matters for the title of the story. Media in 2018 grouped many leaks under the Fappening label, but the label means a campaign against cloud accounts. When the source of a leak is unknown, calling it part of that campaign is a guess.

What the law says in the UK

UK law gives two separate routes, one for breaking into the account and one for sharing the material.

• Getting in. Section 1 of the Computer Misuse Act 1990 makes it an offence to cause a computer to perform a function with intent to secure unauthorised access to data, knowing the access is unauthorised. The maximum on indictment is two years.[13]
• Sharing in 2018. At the time of the leak, section 33 of the Criminal Justice and Courts Act 2015 covered disclosing private sexual photographs or films without consent with intent to cause distress. The Domestic Abuse Act 2021 later extended it to threats.[12]
• Sharing today. Section 188 of the Online Safety Act 2023 inserted new offences into the Sexual Offences Act 2003, in force from January 31, 2024. They cover sharing an intimate image without consent and threatening to share one.[11]

Under the newer rules, one offence needs only that the image was shared without consent and without a reasonable belief in consent. Others add intent to cause alarm, distress or humiliation, or a sexual purpose. Courts decide how each applies to a given case, and this article is not legal advice.[11]

What the law says in the US

The US picture mixes federal and state rules. The 2014 hacking cases were charged under the Computer Fraud and Abuse Act, which is how one phisher ended up with 18 months in federal prison for unauthorized access to a protected computer.[7]

• Civil claims. In 2022 Congress added a federal right for people whose intimate images were disclosed without consent to sue for damages or an order. States have had their own laws for about twelve years.[14]
• Criminal publication. The TAKE IT DOWN Act, signed May 19, 2025, makes it a federal crime to knowingly publish an intimate image of an identifiable adult without consent in defined circumstances. Penalties for adults reach two years in prison.[14]
• Platform duty. Covered platforms must remove a reported image within 48 hours of a valid notice and try to remove known copies. The FTC enforces this, and it runs a reporting page for platforms that fail to act.[14][15]

The Act was passed in 2025, after the February 2018 video. It does not reach back in time, but it shapes what a victim can do today.

How such account takeovers happen

Apple said in 2014 that the celebrity accounts it examined were not opened through a flaw in iCloud. The company described a targeted attack on user names, passwords and security questions.[6] Court records from the following years show the usual methods.

• Phishing. The Pennsylvania defendant sent emails that appeared to come from Apple or Google and asked for credentials. When victims replied, he could read their email and download iCloud backups.[7] A fourth suspect sent fake Apple support emails, according to prosecutors.[9]
• Reused passwords. The NCSC says the most common way passwords get stolen is a data breach at a company that holds them. Criminals then try the same password elsewhere, a trick called credential stuffing.[17]
• No second step. With only a password, a stolen password is enough. Apple says two-factor authentication stops anyone who knows the password from signing in on a new device without a code.[16]
• Security questions and email. Apple named security questions as a target in 2014, and an inbox that is not protected can be used to reset other accounts.[6]
• Cloud sync by default. Phones back up photos automatically, so one stolen login can expose years of material without the owner knowing what is stored.

The last point is our analysis, based on the cases above. In the Pennsylvania case the defendant used software to download whole iCloud backups, so the owner never had to open a single file for the data to leave.[7]

If you want to learn how to spot these emails, our guide on how to report phishing lists the signs and the places to send a report.

How criminals use leak news as malware bait

Every new leak story brings a second crime. Scammers know that people search for the news and click on anything that claims to show it.

Malwarebytes described one such campaign in March 2017. Spam posts promised leaked material and told people to accept a Twitter app first. One shortened link was clicked close to 7,000 times. The app asked for permission to read the timeline, post for the user and access direct messages, and then pushed people to a survey.[10] Nothing in the promised material appeared.

The FTC lists the same pattern for email and text scams: a story that fits the news, a link, and a request to log in or install something.[18] We covered the technique in detail in how criminals use Fappening bait to spread malware.

• Never install an app or a browser add-on to see a leak.
• Treat download links in forums, replies and direct messages as hostile.
• If you clicked and granted access, revoke the app in your account settings and change the password.
• Run a malware scan and check whether your email shows up in a known breach on our breach check page.

Six step account protection checklist

1. Turn on two-step login for your cloud and email. The NCSC calls 2-step verification one of the most effective ways to protect accounts, even when the password is strong.[17] On an Apple Account it takes a few taps in Settings.[16]
2. Use a different password for every account. A password manager makes this practical, and it limits the damage when one site is breached.[17]
3. Secure your email first. Email is the key to reset every other account, so give it the strongest protection you have.
4. Do not log in from links. Open the app, or type the address yourself. The FTC warns that phishing messages often claim a problem with your account.[18]
5. Review sign-ins, apps and backups. Remove devices and third-party apps you do not recognize, and check which photo folders sync to the cloud.
6. Know where to report before you need to. Save the links to report cybercrime and to the platform's help page. Quick action helps.

If your identity details were also part of a breach, a free credit freeze blocks new accounts in your name. Our guide to freezing your credit walks through it, and the breaches section lists recent incidents.

If your private images are shared without consent

Do not reply to the poster and do not pay anyone who threatens to publish. Save the page address, the account name and the date as evidence, then report it.

• Report to the platform using its intimate image or non-consensual content form.
• In the US, if a covered platform does not act within 48 hours of your notice, you can report it to the FTC at TakeItDown.ftc.gov.[15]
• Report the crime to the police. In the UK this can fall under the Online Safety Act offences, and in the US under federal and state law.[11][14]
• Change the passwords of your cloud, email and social accounts and turn on two-step login before anything else is done.

What is still unknown

• Source of the video. No report shows whether it came from a stolen account, a lost device, a person who had a copy, or something else.[2]
• Identity of the poster. The Twitter account was anonymous, and we found no public report naming the person.[1]
• Police outcome. The representative said a report would be filed. We found no later public statement from police or prosecutors.[1]
• Spread of copies. The old text says the original post was removed and copies may keep spreading. No source measures how far that went.

If a later report fills any of these gaps, we will update this page. Until then, the honest summary is that the case is a reminder of how private material gets loose, not proof of a hacking campaign.

Frequently asked questions