Ryan Collins, 36, of Lancaster, Pennsylvania, was sentenced Wednesday to 18 months in federal prison for a felony violation of the Computer Fraud and Abuse Act. He was taken into custody immediately after sentencing.
A man pleaded guilty Tuesday to stealing hundreds of nude photos from celebrities in a massive hack that targeted Jennifer Lawrence, Lea Michele, and Kirsten Dunst.
Under a deal reached with prosecutors, Ryan Collins, 36, pleaded guilty to one felony for unauthorized access of a protected computer. Prosecutors say Collins, of Lancaster, Pennsylvania, used a phishing scheme between 2012 and 2014 that involved sending emails requesting username and password information from his targets. The emails were designed to look like they were from Apple and Google and came from addresses including "firstname.lastname@example.org" and "email@example.com," according to court documents.
Once the targets responded, Collins allegedly used the information he received to steal personal information, including nude photos. He also used a computer program to download the entire contents of iCloud accounts, court documents state.
Collins accessed at least 50 iCloud accounts and 72 Gmail accounts, most of which belonged to female celebrities, prosecutors said.
The photos eventually made their way to websites including 4chan and Reddit, where they quickly spread. The Justice Department did not specify which celebrities Collins allegedly targeted, but did say he was involved in "celebgate" — another name for the massive hack that was widely referred to as "The Fappening." Other celebrities targeted in that hack include Anna Kendrick, Cara Delevingne, Victoria Justice, Kate Upton, and McKayla Maroney.
While prosecutors believe Collins hacked and stole the photos, it's still unclear how those images made it onto the internet. Authorities say they have not uncovered any evidence linking Collins to the actual leaks or that he shared or uploaded the information he obtained.
Assistant U.S. Attorney Ryan White told BuzzFeed News investigators used IP addresses to zero in on Collins in September 2014, just weeks after the photos appeared on the internet.
Collins faces a maximum five years in prison, although as part of his plea deal, prosecutors agreed to recommend a sentence of 18 months.