Headline: Major cloud data leak exposes personal contact details of Hollywood stars, researcher says
A significant cyberattack — or cloud data exposure — has led to the disclosure of personal information belonging to several high-profile Hollywood figures, including Angelina Jolie, Robert De Niro and Sharon Stone. Security researcher Jeremiah Fowler discovered last month that nearly 666,000 records dating from 2019 to 2026 were accessible on a cloud storage system, and that some of the files contained personal contacts tied to the Tribeca Film Festival.
Discovery and scope
Fowler uncovered a large database of marketing materials, including press releases, hosted on a cloud platform. Among the items was a backup file named “contacts” that listed phone numbers and email addresses for public figures. The dataset spans 2019–2026 and comprises roughly 666,000 rows of data.
Exposed data and technical details
Beyond basic contact details, the files included a folder cataloging device-related information associated with the email addresses — for example, the type of iPhone used and the installed software version. Fowler warns that these technical fingerprints can provide attackers with additional context about victims’ digital habits, increasing the likelihood of successful social-engineering campaigns or other forms of exploitation.
Celebrities and festival ties
In addition to Angelina Jolie, Robert De Niro and Sharon Stone, the exposed records reportedly included names such as Danny Boyle, Neil Patrick Harris, Michael Douglas and George Lucas. The data appears to be tied to activities surrounding the Tribeca Film Festival, which De Niro co-founded in 2002.
Possible cause and response
Fowler suggested human error as a possible explanation for the exposure, noting the unusual nature of such an incident affecting individuals who typically guard their privacy closely. “This is really unique because these individuals are so private and they protect their contacts, their phone numbers,” he said. After being notified by Fowler, festival officials removed the data from public access; the exact length of time the records remained exposed has not been disclosed.
No signs of active exploitation detected
Fowler’s initial investigation found no evidence of active malicious use — no signs of ransomware or the automated messaging patterns often associated with targeted attacks. That said, the mere dissemination of personal information can enable future scams, impersonation, or account takeover attempts.
Impact and lessons
The incident underscores persistent risks tied to cloud storage of both professional and personal information, even for high-profile organizations and events. Proper access controls, auditability, and secure backup practices remain essential to prevent accidental exposure or targeted breaches.
