During his two-year crime spree, the man from Lancaster County, Pa., claimed over 600 victims. Most were female, many lived in Los Angeles and worked in the entertainment industry. A few — like “Hunger Games” actress Jennifer Lawrence — were A-list celebrities. They had no reason to know the man, 36-year-old Ryan Collins, as he schemed from his home outside Harrisburg.

But he infiltrated and stole the most intimate parts of their digital lives.

Collins was responsible for illegally collecting their nude photos, as federal investigators found during a search for the responsible parties behind the photo leak that caused havoc across the Internet in August and early September 2014. U.S. Middle District of Pennsylvania Judge William W. Caldwell sentenced Collins to 18 months in federal prison Wednesday, negotiated from a possible five-year maximum as part of a plea deal.

In what would become known as Celebgate or the Fappening, after a crude term for masturbation, illegally obtained photographs surfaced on Reddit and 4chan, the Internet message board that is a spawning ground for harmless memes and also is a pernicious troll hive. FBI agents could not find evidence that Collins himself uploaded the images online, however, or otherwise shared them.

What he did admit to was the hack. For nearly two years, between November 2012 and September 2014, Collins stole images by the hundreds. Although the investigators did not mention victims by name, a few of the photographs released in the hack were of women under the age of 18, such as Olympic gymnast McKayla Maroney. Collins pleaded guilty in March to felony computer hacking charges.

A few of the victims spoke out, arguing the crime was worse than a hack normally connotes. “It is not a scandal. It is a sex crime,” Jennifer Lawrence told Vanity Fair in October 2014. “It is a sexual violation.”

The Justice Department described Collins’s “sophisticated phishing scheme” on Thursday. “He sent e-mails to victims that appeared to be from Apple or Google and asked victims to provide their usernames and passwords,” according to a statement from the department. As The Washington Post reported in March, the messages came from “e-mailprotection138@icloud.com,” “secure.helpdesk0019@gmail.com” and other phony email addresses designed to appear legitimate.

If the victims replied — and several did; in the end Collins had illegal access to more than a hundred iCloud and Gmail accounts — he hunted for their nude photographs and videos. Occasionally, the Justice Department noted, Collins ran a software program to download entire Apple iCloud backups. He also operated a scam modeling agency to obtain nude photos, the department said.

Immediately after sentencing, the Justice Department said Collins was taken into custody.

It marked the latest in a series of high-profile cases against hackers, including a 52-month prison term for Marcel Lehel Lazar, or Guccifer, who was sentenced in September. The Romanian hacker was behind the revelation that, as secretary of state, Hillary Clinton used a private email address. U.S. District Judge James C. Cacheris, the judge in Lazar’s case, called cyberattacks on Americans an “epidemic [that] must stop,” The Post reported.

More from Morning Mix