North Branford man admits to hacking iCloud accounts of 250 people, celebrities

HOLLYWOOD, CA - MARCH 04: Jennifer Lawrence attends the 90th Annual Academy Awards at Hollywood & Highland Center on March 4, 2018 in Hollywood, California. (Photo by Frazer Harrison/Getty Images) HOLLYWOOD, CA - MARCH 04: Jennifer Lawrence attends the 90th Annual Academy Awards at Hollywood & Highland Center on March 4, 2018 in Hollywood, California. (Photo by Frazer Harrison/Getty Images) Photo: Frazer Harrison/Getty Images Photo: Frazer Harrison/Getty Images Image 1 of / 6 Caption Close North Branford man admits to hacking iCloud accounts of 250 people, celebrities 1 / 6 Back to Gallery

BRIDGEPORT — A man waived his right to be indicted and pleaded guilty Wednesday to a computer hacking offense related to a phishing scheme that gave him illegal access to more than 250 Apple iCloud accounts, many of which belonged to members of the entertainment industry, according to a release.

George Garofano, 26, of North Branford, was charged with one count of unauthorized access to a protected computer to obtain information, an offense that carries a maximum of five years in prison, the release from the U.S. Attorney’s Office said.

The release said the charge against Garofano stems from an investigation conducted by the FBI in Los Angeles into the leaks of photographs of numerous female celebrities in September 2014, known as “Celebgate.” The U.S. Attorney’s Office for the Central District of California, which is leading the prosecution, filed charges against Garofano Jan. 11, 2018. The parties agreed to transfer the case to Connecticut for further prosecution, the release said.

None of the victims authorized Garofano to access their internet accounts, nor did any of them authorize him to download personal information from their internet accounts, officials said. Court documents state that from April 2013 through October 2014, Garofano hacked the iCloud accounts — many of whom were members of the entertainment industry in Los Angeles as well as non-celebrities who live in Connecticut — through several sophisticated means.

Sometimes, Garofano would phish internet accounts using fraudulent email addresses, designed to look like legitimate security accounts from Apple, the release said. In the email he sent to the victims, Garofano would misrepresent that the victim’s iCloud account had been compromised, with the victim then giving Garofano his or her username and passwords due to the individual’s belief that the email had come from Apple, according to court documents.

In other instances, court documents state Garofano would send phishing emails to victims that, when the victim clicked on a link in the email, would direct the victim to a different website, where the victim would then enter his or her username and password. He would then separately log in to that third-party website and obtain the username and password the victim had entered, the court documents said.

Once Garofano had obtained the victim’s username and password, he would then access, without authorization, the victim’s iCloud account, searching the content of the account and stealing personal information, including nude photographs and videos, the court documents stated.

Court documents said Garofano was also able to access full Apple iCloud backups belonging to numerous victims, including many celebrities, which backups contained sensitive and private photographs and videos. He would also often trade the usernames and passwords, as well as the materials he stole from the victims, with other individuals.

He was released on a $50,000 bail. A sentencing date has not yet been scheduled.

jessica.lerner@hearstmediact.com; @jesslerner on Twitter