The Justice Department announced charges on Friday against a 28-year-old Illinois man, Edward Majerczyk, who has been under investigation for a notorious hacking incident related to celebrities’ private accounts, including those of actresses Jennifer Lawrence and Kate Upton.
According to prosecutors, Majerczyk will plead guilty over using “spear-phishing” attacks to obtain the log-in credentials for more than 300 Gmail and iCloud accounts. The attacks relied on fake security emails from Apple (AAPL) and Gmail (GOOG), which persuaded the victims—30 of whom the FBI identifies as “celebrities”—to provide their passwords.
Using this information, Majercyzk was able to obtain highly personal information, including private photographs and videos. He now faces up to five years in prison.
He is the second person to be charged over the so-called “Celebgate” incident of 2014, in which users of the websites Reddit and 4Chan posted nude photos of famous figures from Hollywood. A 36-year-old man from Pennsylvania, Ryan Collins, likewise pled guilty in March.
“This defendant not only hacked into e-mail accounts–he hacked into his victims’ private lives, causing embarrassment and lasting harm,” said Deirdre Fike, an Assistant FBI Director, in last week’s statement.
The FBI is not accusing either man, however, of uploading the photos to the websites. Instead, the man are being charged with violating the Computer Fraud and Abuse Act, which forbids unauthorized access to protected computers.
This suggests the FBI is still conducting an investigation over who leaked the nude photos, which appeared widely online for several weeks in 2014.
Get Data Sheet, Fortune’s technology newsletter.
Earlier this year, Gawker reported the FBI raided the homes of Chicago-area men, including Majercyzk, who is named in court documents that say he hacked accounts belonging to “JL, JV, KU.” (The initials almost certainly stand for Lawrence, Upton, and Detroit Tigers pitcher Justin Verlander.)
Prior to the Reddit and the 4Chan leaks, the stolen celebrity photos were traded between small groups of people online. The release of the images to the broad public triggered a flurry of media attention, but also sympathy for the actresses.
The incident also provoked a wider debate about the security of Google and Apple’s cloud services, and about the need for individuals to be vigilant about spear-phishing and other hacking tactics that rely on tricking the victim into providing their passwords.
