Security researcher Jeremiah Fowler found a publicly accessible database, named simply "contacts", connected to the Tribeca Film Festival. It held phone numbers, email addresses and device-related information. He reported finding it days before the festival opened on 3 June, and it was secured after organisers were notified.
The names reported in the records read like an awards ceremony: Angelina Jolie, Robert De Niro, Martin Scorsese, George Lucas, Jennifer Lawrence, Morgan Freeman, Rami Malek, Eva Mendes, Michael J. Fox, Ron Howard and Guillermo del Toro. Fowler described it to The Sun as "by far the biggest collection of celebrity data I've ever seen".
Worth being precise: this was an exposed database, not a hack. Nobody had to break in. And the reporting rests largely on one researcher's account — treat the specifics as his findings rather than a confirmed corporate disclosure.
These are the best-protected contact details in the world
That is what makes it instructive. These people have agents, publicists, lawyers and non-disclosure agreements standing between them and the public. Their contact details are guarded as a professional asset. It still was not enough — because the failure was never about how carefully they guarded the address.
Contact details do not usually leak because their owner was careless. They leak because addresses are shared: with a festival, a studio, a booking system, an assistant's laptop. Every copy is a place they can escape from, and you do not control the security of a single one of them.
The arithmetic of one address
Give one address to fifty organisations and it has fifty chances to leak. When it does, you cannot tell which copy escaped. Your options are to live with it, or to change the address everywhere at once and lose years of contacts, logins and history in a single move.
The problem was not that the address leaked. It is that there was only one of it.
Segmentation, not secrecy
The people in that database already segment everything else — one number for the agent, another for family. Email deserves the same treatment, and it costs nothing. A festival gets one address, a studio another, a newsletter a third.
This is the same failure as the Missouri voucher leak, in a glossier setting: your data sitting in an organisation you cannot audit, exposed without anyone attacking you.