Tribeca Festival data exposure leaks one of the largest collections of celebrity data on record

An unsecured online database connected to the Tribeca Festival left hundreds of thousands of records exposed to the open internet, including a backup file containing contact details tied to prominent filmmakers and actors, according to the cybersecurity researcher who found it. The festival says the information was removed as soon as it was discovered and disputes that any personal contact information belonging to talent was disclosed.

Jeremiah Fowler, a researcher affiliated with Black Hills Information Security who publishes findings through ExpressVPN, said he located the exposed data using a specialized search tool that scans for publicly accessible internet-connected devices and servers, a method he compared to a search engine built for connected hardware rather than webpages. Fowler said he came across the material in the days before the festival’s 2026 edition opened on June 3.

Fowler said the exposure totaled 666,369 records, with timestamps dating back to 2019. Much of the material consisted of marketing files, press kits and promotional images, he said. But among the exposed files was a backup document holding roughly 135,000 contacts, which Fowler said he believed were largely people who had signed up for mailing lists or registered for events, and a separate folder labeled "contacts" containing 13,535 entries.

That folder, according to Fowler, included names, addresses, phone numbers and email addresses tied to figures such as Martin Scorsese, Francis Ford Coppola, Guillermo del Toro, Ron Howard, George Lucas and Danny Boyle, along with actors including festival co-founder Robert De Niro, Jennifer Lawrence, Angelina Jolie, Morgan Freeman, Rami Malek, Sharon Stone, Michael Douglas, Neil Patrick Harris, Winona Ryder, Eva Mendes and Michael J. Fox. Fowler said some entries were incomplete or listed contact information for assistants, managers or publicists rather than the individuals themselves, and he said he observed a number of personal email addresses from consumer providers such as Google and Yahoo among the records.

Fowler attributed the exposure to human error, saying the backup file had been left inside a live production environment rather than being taken offline or stored separately, and that the file was unencrypted and rendered in plain text. He said that configuration meant anyone with an internet connection and access to the same search tool could have viewed the data through an ordinary web browser. Fowler said he did not download the records, reviewed only a limited sample and disclosed the exposure to festival organizers rather than publishing the data itself. He also said he saw no indication that anyone else had accessed the material, noting that a prolonged exposure would typically be accompanied by ransom demands, which were absent in this case.

Tribeca Festival, co-founded in 2002 by De Niro, Jane Rosenthal and Craig Hatkoff as part of an effort to revitalize Lower Manhattan following the September 11 attacks, concluded its 25th anniversary edition on June 14 after running from June 3 through that date. The festival has hosted premieres for films including "The Avengers" and "The Handmaid’s Tale" and has presented awards to films such as "Let the Right One In."

In a statement, a Tribeca Festival spokesperson said none of the talent named in reporting on the exposure had personal contact information disclosed, characterizing the bulk of the exposed material as public-facing business information already available elsewhere, including contacts for public relations representatives, talent representatives and the festival’s front office, along with information drawn from the festival’s website.

The spokesperson said all of the information was removed promptly after the exposure was discovered. The festival disputed some of Fowler’s findings in a phone conversation, according to Fowler, though it acknowledged that some contacts may have belonged to managers or assistants rather than the individuals themselves.