A Pennsylvania man charged in the “Celebgate” investigation pleaded guilty Tuesday to illegally hacking the Apple and Google email accounts of Hollywood celebrities and stealing their videos, photos and naked selfies.
Ryan Collins, 36, of Lancaster, Penn., pleaded guilty to a felony violation of the Computer Fraud and Abuse Act after Los Angeles-based FBI agents identified him as one of those who hacked into Hollywood stars’ emails and other communications and stole images.
Collins has agreed to plead guilty to one count of unauthorized access to a protected computer to obtain information, according to authorities. He is the first person to plead guilty in connection with a widespread celebrity hacking investigation that began in 2014.
Federal prosecutors say Collins used a phishing scheme to obtain the user names and passwords of his victims between November 2012 and September 2014. Prosecutors say he sent emails to victims that appeared to be from Apple or Google and asked the account-holders to provide their log-in data.
In some instances, Collins used a software program to download the entire contents of the victims’ Apple iCloud backups, according to the plea deal.
“We continue to see both celebrities and victims from all walks of life suffer the consequences of this crime and strongly encourage users of Internet-connected devices to strengthen passwords and to be skeptical when replying to emails asking for personal information” said David Bowdich, the assistant director of the FBI’s Los Angeles field office.
Federal authorities learned of Collins’ hacking while they were investigating “Celebgate” — the widespread posting of stolen, nude celebrity photos on the Internet in September 2014.
Although authorities said they did not uncover evidence linking Collins to the posting of photos on public websites, they learned of his phishing scheme as they reviewed the victims’ email accounts.
As part of the plea agreement, authorities have agreed to transfer the case to federal court in Harrisburg, Penn., near Collins’ home. It is there that he will enter his guilty plea and appear for sentencing.
Prosecutors are recommending a prison term of 18 months, according to the plea agreement. The sentencing judge however is not bound by that recommendation and may impose the statutory penalty of five years in prison.
“Today, people store important private information in their online accounts and in their digital devices,” said U.S. Atty. Eileen M. Decker. “Lawless unauthorized access to such private information is a criminal offense. My office remains committed to protecting sensitive and personal information from the malicious actions of sophisticated hackers and cybercriminals.”