Leaked to the Internet
On August 31, 2014, a collection of almost 500 private pictures of various celebrities, mostly women, and with many containing nudity, were posted on the imageboard 4chan, and later disseminated by other users on websites and social networks such as Imgur and Reddit. The images were initially believed to have been obtained via a breach of Apple’s cloud services suite iCloud, but it later turned out that the hackers could have taken advantage of a security issue in the iCloud API which allowed them to make unlimited attempts at guessing victims’ passwords. However access was later revealed to have been gained via targeted phishing attacks.
The event, which media outlets and Internet users referred to under names such as “The Fappening” (a portmanteau of the words “fap”—a slang term for masturbation—and the word “happening”) and “Celebgate”, was met with a varied reaction from the media and fellow celebrities. Critics felt that the distribution of the images was a major invasion of privacy for their subjects, while some of the allegedly depicted subjects questioned their authenticity. The leak also prompted increased concern from analysts surrounding the privacy and security of cloud computing services such as iCloud—with a particular emphasis on their use to store sensitive, private information.
Procurement and distribution
The images were obtained via the online storage offered by Apple’s iCloud platform for automatically backing up photos from iOS devices, such as iPhones. Apple later reported that the victims’ iCloud account information was obtained using “a very targeted attack on user names, passwords and security questions”, such as phishing and brute-force guessing. It was initially believed that the images were obtained using an exploit in the Find My iPhone service. Court documents from 2014 indicated that one user created a fake email account called “appleprivacysecurity” to ask celebrities for security information. The photos were being passed around privately for at least a couple of weeks before their public release on August 31. There are claims that unreleased photos and videos exist. The Daily Mail cited anonymous posters from 4chan and Deadspin who stated that a ring of hackers, traders, and sellers had been operating for months leading up to the mass release.
The hacker responsible for the leak, who described themselves as being a “collector”, distributed the leaked images on the image boards 4chan and Anon-IB in exchange for Bitcoin. Ultimately, the images were widely circulated online via other channels, including Imgur and Tumblr. Celebrity gossip blogger Perez Hilton also re-posted some of the photos on his blog, but soon took them down and issued an apology, saying “he had acted in bad taste”.
A major center of activity was the link-sharing website Reddit, where a subreddit was created for sharing the photos; in a single day, it amassed over 100,000 followers. Reddit administrators were criticized for allowing this to take place in an alleged violation of their anti-doxing rules. As McKayla Maroney claimed to be under 18 at the time the photos of her were taken, Reddit staff took photos of her down and warned that anyone re-posting them, or underage photos of Liz Lee which had been circulating prior to this incident, would be permanently banned from the site and could be prosecuted for distributing child pornography. On September 7, citing copyright issues, Reddit banned its “TheFappening” subreddit, also saying the workload of dealing with them had become too much. Reddit banned another subreddit named “Fappening” on the same day.