Tribeca Festival Data Breach Exposes Contact Information for Jennifer Lawrence and Dozens of Hollywood Figures

A cybersecurity researcher has revealed that the Tribeca Festival suffered a significant data breach exposing contact information for Jennifer Lawrence, Robert De Niro, Angelina Jolie, and dozens of other entertainment industry figures. Security expert Jeremiah Fowler discovered approximately 666,369 exposed records, with sensitive details including personal phone numbers and email addresses found within backup database files.

The Discovery and Scale

Jeremiah Fowler, a cybersecurity researcher with 15 years of experience working for Black Hills Information Security, identified the breach using an Internet of Things search engine—a specialized tool designed to locate exposed databases and connected devices. The exposed records contained data ranging across multiple years, with timestamps extending to 2026. In addition to Lawrence and De Niro, the breach affected contact information for prominent figures including director Martin Scorsese, filmmaker Francis Ford Coppola, actress Angelina Jolie, director Danny Boyle, and actors Michael Douglas, Rami Malek, and Sharon Stone.

Fowler described the discovery as particularly significant, stating it represented the largest collection of celebrity data he had uncovered. Among the exposed materials were three separate databases linked to the Tribeca Festival, which was established in 2002 by De Niro, Jane Rosenthal, and Craig Hatkoff as an initiative to revitalize Lower Manhattan following the September 11 attacks.

Nature of Exposed Data

The Tribeca Festival issued a statement clarifying that the majority of exposed information consisted of publicly available business contact details, including press representative contacts, talent agency information, and front office email addresses. Marketing materials, press kits, and promotional images made up the bulk of the 666,369 records. However, a backup file contained a folder labeled "contacts" with 13,535 entries holding more sensitive personal information, including residential addresses, phone numbers, and private email addresses associated with entertainment professionals and celebrities.

The festival confirmed that all exposed information was removed immediately upon discovery. The organization stated that no personal contact information for the talent referenced in reporting had been compromised, though the existence of the "contacts" folder contradicted this assertion to some degree. Fowler attributed the breach to human error rather than malicious intent.

Industry Context

The incident highlights ongoing cybersecurity challenges facing high-profile organizations handling sensitive celebrity information. Fowler emphasized the unique vulnerability, noting that individuals in the entertainment industry typically maintain strict privacy protocols around personal contact details. The potential for such data to be exploited by malicious actors—whether through targeted phishing, social engineering, or other cybercrimes—underscores the need for enhanced security measures in cloud storage systems managing celebrity information.