What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Celebgate was not established as a single system-wide iCloud breach. Official U.S. Department of Justice records describe several separate account intrusions, many carried out with fake Apple or Google security emails that tricked people into giving up credentials. In another documented case, the intruder used answers to security questions researched from victims’ Facebook accounts. Stealing account contents and publicly posting images were separate acts—and prosecutors said they found no evidence that some defendants had published the photos.
How were the celebrity photos stolen?
In September 2014, private photographs of numerous female celebrities were leaked online. The prosecutions that followed documented a collection of separate intrusions, rather than one operation in which an attacker broke into Apple’s systems and accessed every victim’s account. The cases involved different people, periods, services, and methods.
In several cases, the method was phishing: an email impersonated Apple or Google security or support, then asked recipients to provide credentials or enter them on a website controlled by the attacker. Those credentials could then be used to access email accounts, iCloud backups, and other private material. In a separate case, an intruder also used security-question answers found through victims’ Facebook accounts.
The official records establish how defendants accessed accounts in their respective cases. They do not provide a complete technical account of every intrusion or the full origin and distribution chain for all the leaked images. The intimate images are not reproduced or linked here; the relevant issue is the theft of private material and the distinction between access and publication.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Was iCloud hacked in Celebgate?
The DOJ records describe unauthorized access to individual iCloud accounts, alongside access to Gmail and other accounts. They document phishing and, in one case, researched security-question answers. They do not establish a system-wide breach of Apple’s iCloud service as the explanation for the leak.
A convincing message that appears to come from a service can lead a victim to hand over a password or enter it on a fraudulent site. Once an attacker has working credentials, accessing an account is different from exploiting a flaw in the provider’s infrastructure. The prosecuted cases support the former explanation for the intrusions they describe; they are not a complete technical explanation for every image later circulated.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
How did phishing give attackers access to celebrity accounts?
Phishing emails appeared to come from Apple or Google and framed the request as a security or support matter. In the documented cases, victims were asked to provide their credentials directly or to enter them on a third-party page designed to collect them. With the credentials, an intruder could access the account and seek private content such as email, photographs, or backups.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Not every documented intrusion relied only on a fake email. Prosecutors said Christopher Brannan also researched answers to security questions using victims’ Facebook accounts. Publicly available personal details can make account-recovery questions easier to guess, even when an attacker does not know the victim’s password.
What the prosecuted cases establish
The figures below belong to individual cases. They should not be added together as a count of unique Celebgate victims or accounts: the cases are separate and may overlap. Account totals and victim totals also describe different measures.
| Defendant and period | Documented method and accounts | What DOJ said about publication |
|---|---|---|
| Ryan Collins, November 2012 to early September 2014 | Emails appearing to come from Apple or Google obtained credentials. He accessed at least 50 iCloud accounts and 72 Gmail accounts; investigators identified over 600 victims in his case, many connected to the entertainment industry. DOJ sentencing announcement, October 27, 2016. | DOJ said investigators found no evidence linking Collins to the actual photo leak or showing he uploaded or shared the information he obtained. He was sentenced to 18 months. DOJ announcement, updated May 24, 2016. |
| Edward Majerczyk, November 23, 2013 to August 2014 | Fake security emails directed victims to a credential-collecting website. He accessed at least 300 accounts, including at least 30 belonging to celebrities. DOJ announcement, January 25, 2017. | DOJ said investigators had not found evidence that Majerczyk was responsible for any celebrity-photo postings. He was sentenced to nine months. DOJ announcement, January 25, 2017. |
| George Garofano, April 2013 to October 2014 | Emails appearing to come from Apple security accounts asked victims to provide credentials or enter them on a third-party website. He accessed at least 250 iCloud accounts and sometimes traded credentials and stolen material. DOJ described his prosecution as the fourth arising from the Celebgate investigation. DOJ announcement, January 11, 2018. | The cited DOJ announcement describes his account intrusions and trading, but does not establish that he published the leaked celebrity-photo collection. |
| Christopher Brannan, conduct in 2013–2014; sentenced March 2019 | Phishing and researched security-question answers, including information found on victims’ Facebook accounts. He accessed accounts belonging to more than 200 people, including celebrities and non-celebrities, and obtained iCloud backups, photographs, and other private information. DOJ announcement, March 1, 2019. | The cited DOJ announcement documents his access and the material obtained; it does not establish that he published the leaked collection. |
What Celebgate does—and does not—show
These prosecutions show that deceptive account-security messages and weak account-recovery practices can expose highly private material. They also show why it is important to distinguish an intrusion from a later leak: someone who accessed an account is not automatically the person who posted its contents. In the Collins and Majerczyk cases, DOJ explicitly said investigators had not found evidence tying those defendants to the photo postings.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
The government’s statements are case-specific. They do not identify every person involved in the images’ later circulation, nor do they prove that all victims were compromised in the same way. In the Collins case, then-U.S. Attorney Eileen M. Decker said, “Lawless unauthorized access to such private information is a criminal offense.” DOJ announcement, updated May 24, 2016.
How to reduce the risk of phishing and account takeover
The FBI’s general guidance is to treat unexpected requests for passwords with suspicion, avoid unsolicited links, verify a request using contact details found independently, use two-factor or multifactor authentication where available, and avoid oversharing details that could reveal security-question answers. These are general safety measures, not a finding about which protections were or were not enabled on each account in 2014. FBI, “Phishing the Famous,” October 15, 2019.
Quick Recap
- Do not enter a password through an unexpected email link. Open the service’s app or type its known address yourself instead.
- Verify security alerts independently. Use contact details from the provider’s official site or app, not those in the message.
- Enable multifactor authentication. It can add a barrier if a password is stolen, though it does not make a phishing attempt harmless.
- Use security-question answers that are not easy to research. Avoid answers that can be found on social profiles or guessed from public biographical details.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
