Actress Jennifer Lawrence attends the red carpet during the 74th Venice Film Festival on September 5, 2017. Actress Jennifer Lawrence on the red carpet at the 74th Venice Film Festival on Sept. 5, 2017. Photo:

A North Branford man waived his right to be indicted and pleaded guilty Wednesday to hacking the iCloud accounts of 240 people, including celebrities Jennifer Lawrence, Kate Upton and Kirsten Dunst.

Investigators from Connecticut and California said 26-year-old George Garofano engaged in a phishing scheme with other individuals to obtain usernames and passwords for the iCloud accounts.

Authorities said Garofano admitted he sent victims in both states emails that appeared to be from Apple security accounts. The plea agreement states he then encouraged the victims to send him usernames or passwords, or to enter a third-party website, where he would later retrieve their credentials. He then used the information to access victims’ iCloud accounts to steal personal information, including private photographs and videos.

But Garofano’s attorney told the Connecticut Law Tribune Thursday that his client was an unwitting player in the scheme.

“This is a young man who has no criminal record that got involved with some more sophisticated types who turned out to be criminals. He was easily led by these criminal types to do things he would not normally do,” said Richard Lynch, a partner with Lynch, Traub, Keefe & Errante in New Haven. “He was led into this phishing scheme and he was naive and went along with it.”

Garofano is the fourth hacker to be charged in the 2014 breach, which at the time was known as “Celebgate.” According to several media outlets, he and co-conspirators put naked photos of Lawrence, Upton, Dunst and other celebrities on numerous websites, including Reddit.

The hacking took place between April 2013 and Oct. 22, 2014, in Connecticut and California, according to the plea agreement released this week.

The plea agreement states Garofano “would often trade the usernames and passwords, as well as the materials he stole from the victims, with other individuals.”

Garofano pleaded guilty to one count of unauthorized access to a protected computer to obtain information. Garofano, who was released on a $50,000 bond, will be sentenced by U.S. District Judge Victor Bolden in Bridgeport at a date to be determined. Garofano faces up to five years in prison.

“I will argue for a suspended sentence,” Lynch said. “I always tell my clients to hope for the best, but to prepare for the worst.”

Assistant U.S. Attorney Neeraj Patel of the District of Connecticut and Assistant U.S. Attorney Ryan White of the U.S. Attorney’s Office for the Central District of California are prosecuting the case.

Thomas Carson, a representative for the U.S. attorney for the District of Connecticut, deferred all comments to the Central District of California. Neither White nor anyone from the Central District of California could be reached for comment Thursday.