Skip to main content
Press Release

Former High School Teacher Pleads Guilty to “Celebgate” Hacking

For Immediate Release
U.S. Attorney's Office, Eastern District of Virginia

RICHMOND, Va. – A Richmond man pleaded guilty today to unauthorized access to a protected computer and aggravated identity theft.

According to court documents, Christopher Brannan, 31, a former teacher at Lee-Davis High School, intentionally accessed without authorization internet and email accounts, including Apple iCloud, Yahoo!, and Facebook accounts, and thereby obtained complete iCloud backups, photographs, and other private information belonging to more than 200 victims, including both celebrities and noncelebrities. He hacked email accounts by answering security questions that he could easily research by reviewing victims’ Facebook accounts. Brannan also gained access to victims’ accounts by using phishing email accounts to send fraudulent email addresses designed to look like legitimate security accounts from Apple, misrepresenting to the victims that the emails had come from Apple in order to obtain username and password information for the victims’ internet accounts. Because of the victims’ belief that the email had come from Apple, the victims would provide their usernames and passwords. Brannan would then use the fraudulently obtained usernames and passwords to access the victims’ email accounts, search the content of the victims’ email accounts, and obtain personal information, such as sensitive and private photographs and videos, including nude photographs. Brannan would use software such as Elcomsoft to download full iCloud accounts, which he then perused for personal information. Authorities identified Brannan as a suspect during a Los Angeles-based FBI investigation into hacked iCloud accounts commonly known as “Celebgate.”

Brannan pleaded guilty to unauthorized access to a protected computer and aggravated identity theft. He faces a mandatory minimum term of two years in prison for the aggravated identity theft charge, which shall run consecutively to any sentence imposed for the offense of unauthorized access to a protected computer. The total maximum possible penalty is seven years in prison. The parties have made a recommendation, which is not binding on the court, that Brannan be imprisoned for 34 months when he is sentenced on Jan. 25, 2019.  Actual sentences for federal crimes are typically less than the maximum penalties. A federal district court judge will determine any sentence after taking into account the U.S. Sentencing Guidelines and other statutory factors.

This matter stems from an investigation conducted by the FBI in Los Angeles into the leaks of photographs of numerous female celebrities in September 2014. The U.S. Attorney’s Office for the Central District of California, which is leading the prosecution, filed charges against Brannan in April, and the parties later agreed to transfer the case to the Eastern District of Virginia for further prosecution.

G. Zachary Terwilliger, U.S. Attorney for the Eastern District of Virginia, and Adam S. Lee, Special Agent in Charge of the FBI’s Richmond Field Office, made the announcement after Senior U.S. District Judge Henry E. Hudson accepted the plea. Assistant U.S. Attorneys Brian R. Hood of the Eastern District of Virginia and Ryan White of the Central District of California are prosecuting the case.

A copy of this press release is located on the website of the U.S. Attorney’s Office for the Eastern District of Virginia. Related court documents and information is located on the website of the District Court for the Eastern District of Virginia or on PACER by searching for Case No. 3:18-cr-118.

Contact

Joshua Stueve
Director of Communications
joshua.stueve@usdoj.gov

Updated October 22, 2018

Topic
Cybercrime