Pennsylvania man charged with hacking iCloud, Gmail accounts of celebrities, admits to phishing, but prosecutors find no evidence that he shared images
Hacker Admits to Stealing Celebrity Nude Photos, Takes Plea Deal — Prosecutors estimate Ryan Collins, 36, accessed at least 50 iCloud accounts …
Context & Ripple Effects
This charge closes the investigative phase of the Celebgate case that began when the FBI reported almost 600 iCloud accounts breached by the hacking ring. Ryan Collins' admission that his access came from phishing — not an iCloud flaw — reframes the breach from a platform failure to a social-engineering one.
Prosecutors finding no evidence Collins shared the images matters for how the case resolves: it separates the hacking offense from the distribution that made Celebgate notorious, and it foreshadows the pattern seen when the second Celebgate hacker pleaded guilty to phishing 300+ accounts — also without distribution charges.
First-order effects
- Collins takes a plea deal on federal hacking charges, trading a trial for an admitted two-year phishing campaign against at least 50 iCloud and Gmail accounts; prosecutors concede publicly that no evidence ties him to leaking the photos.
- Apple and Google's account-recovery flows are implicated as the attack surface, since the confession centers on credential phishing rather than any exploit of iCloud or Gmail infrastructure.
Second-order effects
- With two hackers now admitting phishing rather than platform breaches, Apple and Google face pressure to harden password-reset and customer-support verification — the same vector behind the later scam where a man impersonated support staff to phish thousands of accounts and steal hundreds of thousands of files.
- Celebrity victims and their camps gain a legal distinction they lacked before: possession without distribution can be prosecuted as hacking alone, shaping how future victims pursue charges.
Third-order effects
- If the pattern holds — multiple prosecutions for phishing-based account intrusion, none for distributing the stolen content — enforcement against cloud-account compromise will center on the credential-harvesting step, pushing email providers to treat impersonation emails as a security threat class, not just spam.
The trend: Cloud-account breaches are being prosecuted at the phishing entry point rather than the leak, making email-based impersonation the industry's recurring weak link.