Tribeca Festival data leak exposed records tied to stars, researcher says

A Tribeca Festival data leak exposed 666,369 records, including a contacts folder with entries tied to major Hollywood names, cybersecurity researcher Jeremiah Fowler said in an ExpressVPN blog post and a Variety interview.

Fowler, who works for Black Hills Information Security, said the exposed material carried timestamps from 2019 to 2026. The records allegedly included contact entries associated with filmmakers and actors including Martin Scorsese, Francis Ford Coppola, Guillermo del Toro, Ron Howard, Jennifer Lawrence, Angelina Jolie, Morgan Freeman, Rami Malek, Eva Mendes, Michael J. Fox and Tribeca co-founder Robert De Niro.

Tribeca pushed back on the most sensitive reading of the findings. In a statement reported by Variety, a festival spokesperson said none of the talent named in recent coverage had personal contact information disclosed, and said most of the material was public-facing business information such as PR contacts, talent representatives, front-office email addresses, festival website information and other already public data.

The spokesperson also said all information was removed promptly after the issue was discovered.

What was exposed in the Tribeca Festival data leak?

Fowler said much of the exposed Tribeca data was not sensitive and included marketing materials, press kits and promotional images. The more serious issue, according to him, was a backup .dump file that he said contained potentially sensitive information.

Inside that backup, Fowler said, was a folder labeled “contacts” with 13,535 entries. He said the entries included names, addresses, phone numbers and email addresses, though he also noted that some fields were blank or listed assistants, managers or publicists rather than a celebrity’s own email address or phone number.

Fowler also told Variety that another document contained about 135,000 contacts, which he believed may have included people who joined mailing lists or attended events.

The festival disputed some of Fowler’s findings by phone, according to Variety, which said it was still awaiting additional comment from Tribeca.

How did Jeremiah Fowler find it?

Fowler told Variety he found the exposed records using an IoT search engine, which he described as a tool that searches connected devices and databases rather than ordinary web pages.

He said the backup file appeared to have been left in a production database and was stored in plain text without encryption. If the file had been encrypted, he said, he would not have been able to view it.

According to Fowler, the exposed data could have been viewed by anyone with an internet connection using a browser and an account with an IoT search engine.

Fowler said Tribeca responded “very fast and professionally” after he reported the exposure. He also said he did not see evidence that anyone else had accessed the data, noting that long-exposed data often appears alongside automated ransomware posts demanding bitcoin, which he did not see here.

Why does this kind of leak matter?

A data leak is the accidental exposure of files or records to people who should not be able to access them. Even if much of the material is public or business-related, email addresses and contact lists can be used in phishing attempts.

Fowler warned Variety that AI tools can make scams easier for people without technical skills, including drafting phishing emails or creating malicious documents. He said his aim in publishing findings is to help organizations find weak spots and improve security, not to embarrass them.

Tribeca was co-founded in 2002 by De Niro, Jane Rosenthal and Craig Hatkoff after the September 11 attacks, with the goal of helping revive Lower Manhattan. Its 2026 festival, the event’s 25th anniversary edition, ran June 3 through June 14 in New York City.

This story draws on original reporting from Variety.