A massive data leak tied to Robert De Niro’s Tribeca Film Festival exposed hundreds of thousands of records and thousands of celebrity contacts in an unencrypted backup file, raising fresh questions about how elites and institutions handle the same privacy and security rules they expect from everyone else.
Story Snapshot
- Cybersecurity researcher Jeremiah Fowler found a publicly accessible Tribeca-related database with 666,369 records, including a “contacts” folder holding 13,535 entries for big-name actors and directors.
- The exposed backup file was reportedly in plain text and unencrypted, making names, emails, phone numbers, and device details viewable to anyone with an internet connection.
- Celebrities reportedly affected include Robert De Niro, Martin Scorsese, Jennifer Lawrence, Angelina Jolie, George Lucas, and many others whose data was tied to Tribeca festival operations.
- Tribeca admits an incident and says the data was mostly marketing material, while a spokesperson insists the talent’s “personal” contact info was not exposed, creating a sharp contrast with the researcher’s account.
Researcher finds huge public database tied to Tribeca
Cybersecurity researcher Jeremiah Fowler says he uncovered a massive set of exposed records linked to the Tribeca Festival, the New York event co-founded by Robert De Niro. Fowler reported a total of 666,369 records sitting open online, with timestamps between 2019 and 2026. Among those files, he found a folder named “contacts” with 13,535 entries. These entries reportedly listed names, mailing addresses, phone numbers, and email addresses for filmmakers and actors connected to the festival.
Fowler told reporters this was “by far the biggest collection of celebrity data” he had ever seen. Coverage notes that the contact list included well-known directors such as Martin Scorsese, Francis Ford Coppola, George Lucas, and Guillermo del Toro, along with stars like Jennifer Lawrence, Angelina Jolie, Robert De Niro, Morgan Freeman, Rami Malek, Eva Mendes, Michael J. Fox, and many others. His account suggests a wide window where this information sat exposed for anyone using a common internet-of-things search engine.
Plain-text backup and device details raise security concerns
The most troubling detail in Fowler’s report is that the backup file holding contacts was in plain text and unencrypted. That means there was no basic protection like encryption to shield names, numbers, or emails from prying eyes. According to Fowler, it was a “human error” to leave this backup in the live database, where it could be indexed and reached from a normal web browser. Reports also say the records included device information, such as iPhone software versions and browser types, tied to individual entries.
Device data may sound technical, but it matters. When phone models, operating systems, and browser versions are exposed, criminals can match people to known software flaws and craft targeted attacks. Fowler warned that famous names in the files could be ripe for phishing emails, malware, or social-engineering attempts that pretend to be trusted contacts. While media outlets note that the majority of the database held marketing materials and press kits, the presence of an unprotected backup with contact and device details is the heart of the security problem.
Tribeca’s response and dispute over “personal” data
After Fowler discovered the leak, he says he notified the Tribeca Festival days before this year’s event began in early June. Reports state the exposed databases were then promptly taken offline, and Tribeca said it takes data security very seriously and is actively investigating. That quick removal suggests some basic incident response, but there is no public forensic report yet. There are no released logs showing how long the data was open or who may have accessed or copied it.
Tribeca’s public messaging pushes back on the most alarming claims. A spokesperson told Variety’s audience that “none of the talent referenced in recent reporting had personal contact information disclosed” and that most exposed information was “public-facing business contact” data for their teams, not the celebrities themselves. At the same time, Fowler and other coverage note that some entries used consumer email services like Gmail and Yahoo, hinting at more personal use, and some fields did point to assistants or managers rather than the stars. Without an independent audit, the exact mix of personal versus business contacts remains unclear.
What this leak shows about elite institutions and data privacy
This story follows a familiar pattern in modern data breaches. First comes a headline about a huge leak of celebrity details. Then, as lawyers and public-relations teams weigh in, the message shifts to say most of the data was “just marketing” or “public contacts.” Here, nearly 666,000 records were reportedly exposed, including thousands of high-profile contacts, but the festival now stresses that much of the content was press kits and mailing lists. That gap between how the data is used and how it is protected raises obvious questions for everyday Americans who are told to lock down their own information.
Tribeca Film Festival Data Breach Exposes Contact Details of Hollywood Stars.https://t.co/YJx3QCVM8X
— Israel (@f1tym1) July 28, 2026
For conservative readers, the lesson is simple and serious. Elite cultural institutions and Hollywood figures benefit from the same digital infrastructure that everyday Americans use, yet still fall short on basic safeguards like encrypting backup files. Meanwhile, the public gets little transparency about who operated the database, how long it was exposed, or whether any criminals grabbed the information. Strong privacy, clear accountability, and limited data hoarding are not partisan ideas; they are common-sense protections that help everyone, from working families to famous names, avoid becoming targets in a world where one “human error” can expose hundreds of thousands of records.
Sources:
pjmedia.com, variety.com, tribune.com.pk, independent.co.uk, telegraph.co.uk
