Hollywood actors Angelina Jolie and Robert De Niro are among several high-profile figures whose personal contact information was reportedly exposed in a recent data breach linked to the Tribeca Film Festival. The incident was first uncovered by cybersecurity researcher Jeremiah Fowler, who identified multiple databases containing sensitive data online last month.
The leaked information is said to include private phone numbers and email addresses of numerous celebrities, including directors Martin Scorsese, George Lucas, and Danny Boyle, as well as actors Morgan Freeman, Jennifer Lawrence, Winona Ryder, Michael J. Fox, Sharon Stone, and Michael Douglas. The data reportedly spans records from 2019 through to 2026 and is believed to consist largely of marketing materials such as press releases stored on a cloud-based system. However, some files allegedly contained personal contact details, often linked to personal Gmail and Yahoo accounts, raising concerns about potential vulnerability to phishing attacks and malware targeting.
Fowler, an employee of the US cybersecurity firm Black Hills Information Security, described the scale of the exposure as “by far the biggest collection of celebrity data I’ve ever seen.” He further highlighted that some of the leaked records included device information associated with the email accounts, such as iPhone model details and browser versions, which could provide malicious actors with useful information for refining cyberattacks.
The researcher reported the breach to representatives of the Tribeca Film Festival shortly before the event commenced on June 3. The festival organizers acknowledged the issue, stating they "take matters of data security very seriously and are actively investigating this issue," and confirmed that the exposed databases had been removed. Details about the length of time the data was publicly accessible and the extent of unauthorized access remain unclear.
Fowler emphasized his role as an ethical security researcher, noting that he did not download the breached data and rather reviewed limited records to verify the exposure and responsibly inform relevant parties. His findings were published in an online blog several weeks after he initially detected the leak.
There is no suggestion that the Tribeca Film Festival itself was responsible for the breach. The organization was contacted for additional comment but declined to elaborate.
The incident forms part of a wider pattern of cybersecurity incidents affecting celebrities in recent years. High-profile hacks have included the 2020 breach of over 100 Twitter accounts—prior to the platform’s rebranding as X—where accounts belonging to public figures such as Elon Musk, Kim Kardashian, Barack Obama, and Joe Biden were compromised to promote fraudulent Bitcoin schemes. Legal proceedings followed, targeting several individuals connected to the scam.
This latest exposure reinforces ongoing concerns about the security of personal data among notable public figures and the potential risks posed by unauthorized disclosures.