Andrew Helton now faces up to 5 years in prison

Feb 21, 2016 23:56 GMT  ·  By

Andrew Helton, 29, of Portland, Oregon, has pleaded guilty to hacking into Apple and Gmail email accounts, from where he stole sexually explicit, nude and/or partially nude images from 13 victims, some of which were celebrities.

According to an FBI investigation, between March 2011 and May 2013, Helton sent out numerous phishing emails, pretending to be Apple or Google.

Email recipients were told to change their passwords using a link embedded in the email. This link led victims to a site under Helton's control, who logged their passwords.

Helton hacked 363 email accounts

Using this simple phishing campaign, Helton gained illegal access to 363 Apple and Gmail accounts.

The hacker went through each inbox, searching for sensitive information. FBI agents say that Helton discovered and stole 161 sexually explicit or nude pictures from 13 victims.

The FBI says that many of these victims were members of the entertainment industry living in Los Angeles. The Bureau declined to provide their names.

"The thought of a stranger accessing your private communications for sport or monetary gain can be devastating," said David Bowdich, the Assistant Director in Charge of the FBI’s Los Angeles Field Office. "This insidious crime has distressed scores of average individuals, as well as celebrity victims."

Not the man behind The Fappening

Helton's case looks extremely similar to how The Fappening took place, which also employed a well-crafted and well-executed phishing campaign.

Helton's not the man behind those nude image and video leaks. Two other hackers are suspected for The Fappening leaks, Emilio Herrera of Chicago, and Ed Majerczyk, also from Chicago.

Helton's phishing campaign also took place one year before The Fappening, and since the FBI did not reveal the name of the celebrities, it may be that Helton never released the pictures on the Internet.

Helton agreed to a charge of unauthorized access to a protected computer to obtain information, which is a felony violation of the Computer Fraud and Abuse Act.

For his crimes, he faces up to five years in prison. Helton's sentencing is scheduled for June 2, 2016.