Remember how last summer the Internet practically shut down when nude and sexually explicit images of numerous female celebrities were posted to 4chan and Reddit without their consent? The world then helped make those images go viral.  The leak of the private photographs was popularly known as “Celebgate” and “The Fappening.”

Gawker published new information about a pending investigation of those behind these invasions.  And the invasion was far more widespread than any of us realized — not just celebrities were hacked. The report reveals that back in mid-October, 2014 the FBI’s Cybercrimes Unit seized a slew of storage devices and computers  (and two floppy disks?!) from one Emilio Herrera of Chicago, Illinois.

According to the Application and Affidavit for a Search Warrant submitted by Special Agent Josh Sadowsky, offenses Herrera is being investigated include:  conspiracy, computer fraud, fraud in connection with email, wire fraud, and copyright infringement.

The affidavit confirms for the first time that indeed the crime occurred via a phishing scheme into Apple iCloud.

Phishing occurs when a fraudulent email or text message claims to be from a legit Internet provider and seeks the victim’s login and password information. The victim is then directed to an illicit website or is asked to respond with their username and password which the offender then uses to gain access into the victim’s account.  A tool called Elcomsoft Phone Password can be purchased online and downloaded by anyone.  It enables a user to download the contents of a victims iCloud account if the username and password are known.

Between May 31, 2013 and August 31, 2014, the IP address associated with Emilio Herrera was used to access 572 unique iCloud accounts.  Many were accessed numerous times, with a total of 3,263 accesses altogether.  Attempts to reset iCloud account passwords were made 4,980 times on 1,987 accounts.  That breaks down to about ten attempts per day to reset passwords during that fifteen month period.

The majority of those accounts belonged to celebrities, models, and the friends and families of them.

From the conspiracy charges, we know that Herrera was not acting alone.  This is corroborated by The Chicago Sun-Times’report that a second home in Chicago was raided by the FBI. The affidavit in that case is still sealed, but this second IP address accessed 291 account more than 600 times.  This affidavit reportedly contains details of a victim interview in which a person with the initials J.L. interrupted the interview because she was “very distraught” and “stated she was having an anxiety attack and was visibly shaken.”

So, the feds have now had evidence for eight months now.  Yet nobody has been arrested.  So what’s fappening with the investigation?!?!?!