Thousands of Hollywood actors and directors exposed in massive database leak

We imagine that being one of Hollywood's biggest names comes with some pretty hefty security concerns.

When not being hounded by the press or having your private lives splashed over the front page, what if a fan becomes a little too obsessed with you?

After all, John Hinckley Jr. tried to assassinate President Ronald Reagan in a bizarre attempt to 'impress' Jodie Foster.

In 1989, there was also the tragic case of Rebecca Schaeffer, with the 21-year-old My Sister Sam being killed by Robert John Bardo, an obsessed stalker who'd gotten her address through a private investigator.

As we enter an increasingly technologically advanced age, hackers are becoming more sophisticated at delving into our private lives. It's not just the general public in danger of having their financials and more exposed, as we're sure Jennifer Lawrence can tell you after her nudes were leaked in the 2014 iCloud hack that some referred to as 'The Fappening'.

Now, the Tribeca Film Festival is left looking red-faced after cybersecurity researcher Jeremiah Fowler apparently gained access to its database and gained 666,000 records belonging to everyone from Angelina Jolie to Robert De Niro, Michael J. Fox to Sharon Stone, as well as directors including Martin Scorsese, Guillermo Del Toro, George Lucas, and more.

Writing on his ExpressVPN blog, Fowler explained how the leak shows vulnerabilities in Tribeca's security.

He's thankfully not a bad actor, and while the majority of the data was mundane information like press releases and film schedules, he claims to have found thousands of emails and phone numbers in a backup file.

Fowler says he came across the database that wasn't password protected or encrypted, locating 666,369 files with information ranging from 2019 to 2026. Most worryingly, the .dump backup included IP addresses and hashed passwords.

The security expert says he immediately got in touch with people associated with the Tribeca Film Festival, and after the backup file was removed the same day, he got the following message: "Thank you for bringing this information to our attention. We appreciate your responsible disclosure. Tribeca takes matters of data security very seriously and is actively investigating this issue."

Fowler reiterated that it's unclear whether the database was managed by the Tribeca Film Festival, Tribeca Enterprises, or a third party, adding that he doesn't know whether anyone else had previously accessed the credentials of these A-listers. Only an internal forensic investigation can rule whether others accessed the information.

He went on to state: "A large number of these emails used services such as Yahoo, Gmail, Outlook, etc. indicating they could potentially be personal contacts. I am not implying or claiming that these individuals were ever at risk or that their information is part of a broader public exposure."

Reminding us that this kind of information could be used for phishing, impersonation attempts, and further reconnaissance, he suggests that backup files are some of the most overlooked when it comes to data security.

Although Fowler implies no wrongdoing on Tribeca's behalf, he pointed to an FTC warning about scammers impersonating celebs on social media. A 2025 FTC consumer protection data report said that impersonation scams had soared fourfold in adults aged 60 and over in the past couple of years.

That's especially related to losses exceeding $100,000, with a total reported losses leaping from around $55 million in 2020 to roughly $445 million in 2024.

We previously reported on the woman who was scammed out of $850,000 by an AI version of Brad Pitt, but with celebrity details being potentially leaked, imagine George Clooney getting a text from someone she assumed is Brad, only to find out it's a scammer.