666,369 Records Unsecured: Tribeca Festival Database Exposed Online

From a cybersecurity perspective, the Tribeca Festival incident is a stark reminder that even high-profile events neglect basic cloud security hygiene. A database of 666,369 records, including names, addresses, and emails of celebrities like Angelina Jolie, sat exposed for years—accessible to anyone with an IoT search engine. Threat actors could leverage this data for targeted phishing, social engineering, and physical security risks.

In July 2026, a routine scan by cybersecurity researcher Jeremiah Fowler uncovered a publicly accessible cloud database linked to New York's Tribeca Festival, exposing 666,369 records — including sensitive contact information of A-list celebrities like Angelina Jolie. The database, left without authentication, contained files from 2019 to 2026, with a dedicated 'contacts' folder holding over 13,500 entries. While most data consisted of marketing and promotional materials, the contact records revealed names, physical addresses, phone numbers, and email addresses of some of Hollywood's most recognizable figures, such as Jennifer Lawrence, Martin Scorsese, Robert De Niro, and Morgan Freeman.

“

If California residents were among the affected, the California Consumer Privacy Act (CCPA) allows statutory damages of $100 to $750 per consumer per incident.

The exposure raises profound questions about data stewardship in the entertainment sector, where the fusion of celebrity culture and weak cybersecurity hygiene creates a lucrative target for malicious actors. Fowler found the database using a simple IoT search engine — essentially a search tool for connected devices — indicating a failure of even rudimentary access controls. This was not a sophisticated breach but a configuration oversight, a recurring theme in cloud storage leaks across industries.

Legally, Tribeca Festival now faces potential liability under multiple privacy regimes. Given its international attendee list, the database almost certainly included European residents, triggering the EU's General Data Protection Regulation (GDPR) with its stringent 72-hour breach notification mandate and fines of up to 4% of annual global turnover. If California residents were among the affected, the California Consumer Privacy Act (CCPA) allows statutory damages of $100 to $750 per consumer per incident. New York's SHIELD Act, with its 'reasonable safeguards' requirement, further complicates the festival's position. Tribeca's response — that the leak did not expose 'private personal information' — may be an attempt to minimize liability by arguing that much of the data was business contact details (agents, publicists). However, in a celebrity context, such distinctions can be blurry; a manager's phone number can lead directly to the star, and home addresses of high-profile individuals carry grave security risks.