‘The Fappening’ Hacker Pleads Guilty And Reveals How iCloud Accounts Were Hacked

A Pennslyvania man has agreed to plead guilty to one felony charge related to the leak of hundreds of explicit images of more than a dozen celebrities in 2014, an incident which was widely referred to online as “The Fappening” or “Celebgate.”

According to a document filed by the Department of Justice on Tuesday, 36-year-old Ryan Collins of Lancaster, Pennslyvania has signed a plea agreement and agreed to plead guilty to a felony violation of the Computer Fraud and Abuse Act. In the agreement, Collins agreed to plead guilty to one count of unauthorized access to a protected computer to obtain information.

Collins has admitted responsibility for accessing 50 iCloud and 72 Gmail accounts during a period of almost two years, between November 2012 and September 2014. It was at the end of that period, in September 2014, that hundreds of private photos of celebrities were leaked on anonymous image board Anon-IB before spreading to places like 4Chan and Reddit.

Collins was able to access the accounts not by hacking into them directly but by using a social engineering technique known as “phishing,” which saw him send hundreds of emails to accounts belonging to the celebrities he was targeting, posing as an Apple or Google employee. If the celebrities responded, he was able to use the information he obtained to access their email and iCloud accounts. This allowed him to access and download the nude images, which eventually leaked online. Collins was able to download the entire contents of victims' iCloud accounts, giving him access to phone numbers, addresses and notes as well as photos and videos.

While Collins has admitted to breaching the security of the celebrity accounts, the prosecutors have not found any evidence to show he shared or uploaded the information he obtained.

The maximum sentence Collins could face is five years in prison but thanks to a deal struck with prosecutors, the 36-year-old will only serve 18-months' jail time — although “that recommendation will not be binding on the sentencing judge.”