Angelina Jolie and Robert de Niro are among Hollywood celebrities to have had their contact details exposed in a data breach, a cyber-security expert has claimed.

    The actors’ personal phone numbers and private email addresses were reportedly made public after several databases relating to the Tribeca Film Festival were uploaded online.

    Other celebrities whose details are thought to have been breached in the leak include film directors Martin Scorsese, George Lucas and Danny Boyle, as well as actors Morgan Freeman, Jennifer Lawrence and Winona Ryder.

    Jeremiah Fowler, a cyber-security expert who first reported the data breach, said he contacted the Tribeca Film Festival after stumbling upon the leaked information last month.

    The four breached databases allegedly contained around 666,000 records from 2019 to 2026 relating to the annual movie festival in New York, founded by De Niro.

    Martin Scorsese was among the many film directors who have had their personal details leaked online, according to a cyber-security expert

    Martin Scorsese was among the many film directors who have had their personal details leaked online, according to a cyber-security expert – Stefania D’Alessandro/Getty Images

    Most of the files were marketing materials, but one of them contained mobile numbers and email addresses of high-profile celebrities, which Mr Fowler claimed would suggest they could be personal contacts.

    The leak would expose the celebrities to phishing attempts, malware targeting and emails from scammers impersonating their friends and families.

    Mr Fowler, a researcher for US-based firm Black Hills Information Security, told The Sun that it was “by far the biggest collection of celebrity data I’ve ever seen”.

    He added: “What was really interesting was that there was a folder that captured their device information based off the email. It would say what version of an iPhone they were using, if they were using Safari, what version of the software they were using. That could give the bad guys a lot of additional information.”

    The data breach allegedly stemmed from New York's annual Tribeca Film Festival, which was founded by Robert De Niro

    The data breach allegedly stemmed from New York’s annual Tribeca Film Festival, which was founded by Robert De Niro – Dimitrios Kambouris/Getty Images

    Mr Fowler claimed he flagged the leaked databases to the Tribeca Film Festival last month just days before the organisation’s annual 12-day event started on June 3.

    The festival responded to Mr Fowler at the time that it “takes matters of data security very seriously and is actively investigating this issue”, adding that it had since removed the databases.

    It is not clear how long the information was publicly available online or who accessed it and there is no suggestion that the Tribeca Film Festival was responsible for the alleged leak. The Telegraph has contacted the organisation for comment.

    Jennifer Lawrence was one of the public figures who had their private contact details allegedly leaked

    Jennifer Lawrence was one of the public figures who had their private contact details allegedly leaked – Christopher Polk/Getty Images

    Mr Fowler shared his findings in an online blog for a VPN company on Saturday, more than a month after he claimed he first accessed the information.

    He wrote: “As an ethical security researcher, I do not download the data I discover.

    “In my research, I review a limited number of records to verify and responsibly report on the nature of an exposure, as well as to document any publicly exposed information. My goal is to responsibly notify relevant parties and raise awareness about the importance of protecting potentially sensitive data.”

    Celebrities have been targeted by a slew of online hacks in recent years, including a data breach of more than 100 Twitter accounts in 2020, before the company was renamed X.

    Accounts belonging to Elon Musk, Kanye West, Kim Kardashian, Barack Obama, Joe Biden, Bill Gates and Jeff Bezos were among around 130 profiles hijacked to promote a Bitcoin scam.

    Graham Ivan Clark, a US teenager who was 17 when he co-ordinated the hack, pleaded guilty to the incident the following year.

    Joseph James O’Connor, a 26-year-old from Liverpool, was also sentenced to five years for cybercrimes in relation to the hack, while two others were charged in connection with the scam.

    Try full access to The Telegraph free today. Unlock their award-winning website and essential news app, plus useful tools and expert guides for your money, health and holidays.

    Share.

    Comments are closed.