The Fappening in 2026: Celebgate Hackers and iCloud Risks

The Fappening in 2026: the short answer

The Fappening, also known as Celebgate, is a closed criminal case. Private photos of Jennifer Lawrence, Kate Upton and other celebrities leaked online in 2014, and by 2019 five men had been convicted and sentenced in the United States.[6][7] George Garofano, the subject of our original report below, received eight months in prison in August 2018.[2]

The most important lesson has not changed. iCloud itself was not broken into. Investigators found that the attackers used phishing emails and guessed security questions to take over accounts one by one.[6] The same tricks still work in 2026, which is why Apple keeps warning users about fake Apple messages and calls.[8] We found no new criminal case tied to the 2014 leak as of 2026.

Timeline: from the 2014 leak to the last sentence

What changed since 2018

When we first covered the case in 2018, Garofano was the latest name in a growing list. Half a year later the list closed with Christopher Brannan. He admitted to unauthorized access to a protected computer and aggravated identity theft and received 34 months, the longest Celebgate sentence.[6] Court filings said he reached more than 200 victims across iCloud, Yahoo and Facebook accounts.[6]

Brannan's method shows how low-tech these attacks were. He answered password reset questions with details from the victims' public social media profiles, and he sent phishing emails from addresses that looked like Apple security accounts.[6] Ryan Collins used the same kind of fake Apple and Google emails and also asked some victims for photos under the cover of modeling jobs.[7]

One detail is often lost in the search results. Reports on Collins said that direct evidence of him leaking the photos had not been found.[7] The people convicted were punished mainly for breaking into accounts. Who first posted the files in 2014 is not settled in the sources we read.

Risks around The Fappening searches today (our analysis)

Search terms like "the fappening" and "thefappening pro" still get thousands of searches. In our analysis, that traffic is a target for scammers, not a source of real leaks.

• Leak sites with malicious ads. Pages that promise celebrity nudes often push fake video players, "update your player" prompts and redirect chains that end in adware or scam pages. Our virus removal guides cover the most common ones.
• Fake download buttons. A "download the full pack" file is a common way to deliver password stealers. No real archive needs an installer.
• Phishing that copies Apple. The original attackers posed as Apple security staff.[6] Fake Apple emails, texts and support calls are still in circulation, and Apple warns about all three.[8]
• Harm to victims and legal risk. The photos were stolen. Sharing or reposting them hurts real people, and laws on non-consensual intimate images apply in many countries.

How to protect your cloud account from a Celebgate-style attack

1. Turn on two-factor authentication. Apple tells users to keep two-factor sign-in on for their Apple Account.[8] A stolen password alone is then not enough to download your photos.

2. Use a unique password. Your Apple or Google password should not be used on any other site. A leak elsewhere then cannot open your cloud storage.

3. Do not trust security emails. The Fappening attackers sent emails that looked like Apple security alerts.[6] Open Settings on your device or type the address yourself instead of tapping a link.

4. Never share passwords or codes. Apple says it never asks for your password or verification codes to provide support.[8] Anyone who asks is a scammer.

5. Make reset questions hard to guess. Brannan answered security questions with facts from public social media.[6] Keep birthdays, pet names and schools off public profiles, or use answers that are not true facts.

6. Check for leaks and act fast. Use our leak check to see whether your email appeared in a breach. If you typed your password on a suspicious page, change it at once, as Apple advises.[8]

What is still unknown

• Who first posted the stolen files online in 2014. The sources we read link the convictions to account break-ins, not to proven posting.[7]
• Whether any other suspects were ever charged. We found no case after the 2019 sentence as of 2026.
• How many of the leaked files still circulate. We found no reliable count.

Our original 2018 report

The text below is our report as first published in 2018. We keep it unchanged for the record; the sections above bring it up to date.

On Wednesday, the federal judge at US district court in Bridgeport has sentenced George Garofano to eight months in prison and three years of supervised release for stealing and exposing nude photographs of Jennifer Lawrence and other celebrities in The Fappening 2014 scandal[1].

The 26-year-old hacker has managed to access private information stored on iCloud accounts of 240 people, including Hollywood stars. G. Garofano was one of four cybercriminals who hacked into the accounts and stole personal details along with intimate photos of Kate Upton, Jeniffer Lawrence, Kirsten Dunst, and others.

The prosecutors demanded a sentence of 10 to 16 months in federal prison. However, G. Garofano's lawyer asked for leniency and no more than a five-month punishment with a five-month home confinement[2]. The sentencing memo presented to the court by the prosecutor stated the following:

Mr Garofano's offense was a serious one. He illegally hacked into his victims' online accounts, invaded their privacy, and stole their personal information, including private and intimate photos. He did not engage in this conduct on just one occasion. He engaged in this conduct 240 times over the course of 18 months.

The Fappening hacker pleaded guilty in the court

George Garofano pleaded guilty in April and admitted that he hacked 240 iCloud accounts to access private information[3]. The prosecutor had a solid statement to the court for this offense and emphasized that the attacker not only stole nude photos but also leaked them online:

Not only did Mr Garofano keep for himself the photographs he stole, he disseminated them to other individuals. He may have also sold them to others to earn 'extra income'.

However, the defense said that the crime was conducted when G. Garofano was still in college. Now, he has matured and taking responsibility for such actions[4]:

He now stands before the court having matured, accepting responsibility for his actions and having not been in trouble with the law since <…> There is nothing to suggest that he would ever engage in this or any other criminal conduct in the future.

The attacker impersonated Apple's security team to obtain iCloud logins and passwords

G. Garofano explained that he managed to access 240 different iCloud accounts with the help of social engineering tactics and deceptive spam emails. The hacker impersonated Apple's security team and sent fraudulent emails to the potential targets of interest[5].

The spam emails helped him to collect logins and passwords to iCloud accounts and steal private photographs. Likewise, cybersecurity experts warn to be vigilant and never open suspicious and unverified emails even if they look legitimate. Be cautious to avoid hacking attempts.

Related guides on 2-Spyware

• Check whether your email appeared in a leak
• Recent data breaches
• Virus and malware removal guides
• How to report phishing