Over the last 24 hours, one portion of what's purportedly a huge, months-old cache of private celebrity nude photographs—the product of an "underground celeb n00d-trading ring," according to one anonymous 4chan poster—was leaked to anonymous image boards like AnonIB and 4chan.

Dozens of sexually explicit private photographs, reportedly stolen from the phones and cloud accounts of celebrities like Jennifer Lawrence and Kate Upton, were published to the boards and uploaded to file-sharing services.

But where did the photos come from? How did they leak out? What's this "underground" ring? Here's everything we've been able to glean so far.

The cache has likely been circulating online for some time now.

As far back as "a few weeks ago," a Deadspin reader tipped the sports site to the alleged existence of a large collection of private photographs stolen from celebrities.

A few weeks later, on August 26, anonymous users were posting about a cache of "explicit vids and pics" on a thread dedicated to Jennifer Lawrence on AnonIB—the 4chan-offshoot image board where the photographs were initially being released.

A few hours before the photographs spread across 4chan, Reddit and Imgur, a Twitter user—whose account has since been suspended—referenced "nudes of like 20 celebs" and claimed TMZ had been offering the hackers cash for the photos.

The collection almost certainly represents months (if not years) of work by several hackers...

There's a great deal of evidence—including a statement from one hacked celebrity, Mary Elizabeth Winstead—to suggest many of the photographs were old or had since been deleted. But Deadspin notes that metadata suggests some of the photos were recently taken. (They've constructed a timeline of the photos of Tigers pitcher Justin Verlander, boyfriend of model Kate Upton.)

One anonymous poster claiming to be involved wrote on AnonIB Monday morning that the hacking had been "several months" in the making.

...who may even be part of "underground celeb n00d-trading ring that's existed for years."

While the above poster is likely telling the truth that the nudes were the result of "several months of long and hard work by all involved," most signs point toward not a concerted effort but a loose gang of hackers working independently and trading to create the collection.

Since the leak itself on Sunday, posters on AnonIB—which contains both a "stolen photos" board and a "celebs" board—and 4chan have hinted at some kind of nebulous crew of celebrity-focused hackers involved in trading or selling their "wins." The multiple dates on the photos and multiple apparent vectors for hacking provide some circumstantial support to this idea. One 4chan poster even outlined what he claims was a years-old "ring" of celebrity-photo traders—a group that you could only join by providing your own nudes, or buying your way in.

Just as there are multiple hackers, there are probably multiple leakers.

While the leak certainly started with a single braggart—possibly the aforementioned "rich kid" who bought his way into the alleged trading ring—once the existence of the cache had been confirmed, several others joined in, some hoping to get bitcoin donations in exchange for the photographs.

Some Redditors think this guy is the original leaker, though he vehemently denies it.

A 27-year-old server administrator admitted today to a Buzzfeed reporter that he had demanded money for photographs, but denied being the hacker.

Bryan Hamade, a server administrator for Southern Digital Media, reportedly uploaded a screenshot of his desktop, pictured below, and asked 4chan users to send him money in exchange for the uncensored celebrity photographs.

But Hamade apparently neglected to excise his hard drive and network drive names from the screenshot, and investigators on Reddit quickly matched them to previous uploads made by a user calling himself BluntMastermind.

Earlier today, Hamade told Buzzfeed's Charlie Warzel that he was only trying—unsuccessfully—to scam money from people and wasn't involved in the actual hack.

But despite the repeated denials, Warzel was apparently able to locate evidence suggesting Hamade had successfully ransomed photographs that appeared "only in Hamade's postings."

Hamade—who did not answer or return phone calls from Gawker—appears to have stopped responding to Warzel entirely after claiming to be "driving around trying to find an open law office."

Some photos were hacked through iCloud, but probably not all.

There's evidence that the hackers were able to grab some of the photographs by accessing certain celebrities' Apple iClouds—where, theoretically, archived backups of photo libraries could be ripped and unpackaged.

A Github user reportedly posted a Python script earlier today that allowed for a "brute force" attack against Apple's iCloud service, essentially allowing hackers to repeatedly guess passwords without being shut out. That bug has reportedly been patched, and Apple is reportedly investigating.

But it's likely that some photos were taken through other methods, potentially including Dropbox vulnerabilities or simple social engineering tactics (well known on AnonIB) like researching and correctly answering security questions.

There may be more hacked files out there, but not all are real.

4chan users uploaded a purported "master list" referencing about 100 actresses, singers and athletes. Blacked-out desktop screenshots suggest the existence of unreleased photographs, and users have repeatedly referenced videos that do not appear to be public.

However, several women have already denied the veracity of the photos, including Victoria Justice and Ariana Grande. (While one image of Justice was almost certainly fake, 4chan and Reddit users have gone to great length photo-matching to demonstrate the authenticity of others.) Old, also fake images of Selena Gomez are also reportedly in circulation.

The FBI is involved

"The FBI is aware of the allegations concerning computer intrusions and the unlawful release of material involving high profile individuals, and is addressing the matter," an FBI spokesperson told the LA Times. "Any further comment would be inappropriate at this time."

[image via AP]

Know anything more? Leave tips below, or email gabrielle@gawker.com or tips@gawker.com