Tribeca fest data leak exposes Jennifer Lawrence and Robert De Niro contact info: meet the finder

Show summary Hide summary

• How the exposure was uncovered by a security specialist
• The breadth of what was exposed and who was listed
• What went wrong technically
• Response from the festival and immediate remediation
• No obvious signs of exploitation in public channels
• Why this matters more now because of AI
• Concrete steps organizations should take now
  • Operational checklist for event and media organizations

The Tribeca Festival recently faced a major data exposure that put hundreds of thousands of records online, including contact entries tied to well-known filmmakers and actors. The discovery has sparked fresh concerns about cloud backups, simple human errors and the new risks posed by AI-driven attacks.

How the exposure was uncovered by a security specialist

Cybersecurity researcher Jeremiah Fowler spotted the dataset while traveling in Europe. He published his findings on a security blog and shared details with reporters.

Fowler works with a security firm and has spent years hunting for exposed systems. He used an IoT-focused search engine to locate the dataset. These search tools index internet-connected services and cloud storages, making them useful for defenders and attackers alike.

The breadth of what was exposed and who was listed

Fowler reported a large cache of records spanning multiple years. The totals and date range stood out.

• 666,369 records found, with timestamps from 2019 through 2026.
• A backup file contained a folder labeled “contacts” with roughly 13,535 entries.
• Entries included a mix of consumer addresses, publicists and office accounts, and some high-profile names.

Among the notable figures associated with entries were industry icons and stars. The exposed contact set reportedly included addresses and phone fields tied to prominent names.

What went wrong technically

Fowler described the issue as a human mistake compounded by poor configuration.

The backup file was left in a production environment and stored in readable, unencrypted form. That made every record accessible to anyone who could reach the storage endpoint through an internet-connected browser.

Many entries lacked private contact details and instead pointed to assistants, managers or PR teams. Still, a number of consumer email accounts were visible in the dataset.

Response from the festival and immediate remediation

The festival moved to remove the files after being alerted. A spokesperson said much of the material consisted of business-facing contacts and items already available publicly.

Organizers stated that personal telephone and private email addresses were not part of the widely shared data. They also reported that the exposed content was taken down promptly once discovered.

No obvious signs of exploitation in public channels

Fowler noted he did not find typical indicators of wide abuse, like public ransomware postings demanding payment.

Because the dataset was removed quickly, there was limited evidence that outside actors had accessed and weaponized the information.

Why this matters more now because of AI

Modern AI tools make it easier to scale attacks that once required technical skill.

Bad actors can now generate highly convincing phishing messages or craft social-engineering scripts tailored to individuals in large lists. That raises the stakes when contact lists become exposed.

AI lowers the barrier to mass-targeted scams and malware delivery. Attackers can automate message creation and distribution to thousands of addresses.

Concrete steps organizations should take now

Stopping similar leaks requires both technical controls and process changes.

• Keep backups offline or in isolated storage. Don’t store fail-safes in the same production environment.
• Encrypt sensitive backups at rest and in transit. Encrypted data is far less useful to unauthorized viewers.
• Maintain an accurate inventory of cloud assets and storage endpoints.
• Apply least-privilege access controls and role-based permissions.
• Run routine penetration tests and vulnerability scans, especially for non-technical teams.
• Monitor public indexes and use automated alerts for exposed buckets or databases.
• Train staff on data handling and the increased risk posed by AI-enabled phishing.

Operational checklist for event and media organizations

• Classify what is public versus private before any upload.
• Limit retention of contact lists and delete unused archives.
• Require multi-factor authentication for admin panels and cloud consoles.
• Engage external security partners for periodic audits.