AINEWS
ClarityCheck is a reverse image people search service, which is why the face database it left open was a list of people who never agreed to be in it.
A people-search service promises to identify anyone from a photo. The roughly 9 million faces sitting in its unauthenticated cloud bucket almost certainly never asked to be identified.
ClarityCheck sells reverse-image lookups, the kind of tool a stranger can use to put a name to a face in a candid picture. Its own about page advertises the ability to "identify anyone in a photo" and pull up matching social media profiles in seconds, alongside phone, email, VIN, and name searches. The people those tools are designed to surface are, by construction, the ones who never signed up to be looked up. A face database is the other half of that product, and the names in it are the people the service is built to identify.
The photo collection behind that service sat on an Amazon S3 storage bucket configured to allow public access, with no password and no login prompt. Independent security researcher Jeremiah Fowler found the bucket while reviewing publicly served code on ClarityCheck's own website; the storage URL was embedded in pages anyone could load. He counted roughly 9 million image files totaling about 450 GB, organized into folders literally named "faces" and "profiles," according to WIRED's report on the exposure. A separate misconfiguration on the same service exposed a related database of email addresses and phone numbers, the same kind of failure rather than a coordinated intrusion by a third party.
Fowler says the bucket had been reachable for months and that his initial responsible-disclosure attempts did not reach anyone who could act on them. WIRED contacted ClarityCheck in July, and the company subsequently restricted access to the image database. There is no public accounting of who, if anyone, accessed the bucket while it was open, and Fowler's report does not assert that any third party pulled the data. That uncertainty is part of the story: the damage from a misconfigured biometric bucket is not a single event, it is a standing risk that compounds each day the file sits exposed.
The consent structure makes the scale of that risk different from a normal user-data breach. ClarityCheck's upload flow requires whoever submits a photo to attest that they have the right to do so. The people in the photos are not the uploaders. They are the targets of a service that exists to identify them, and most of them probably do not know a database of their face exists at all. That asymmetry, that the subjects of the dataset never consented to be in it, is what turns a 450 GB misconfiguration into a category-level problem rather than a per-user one.
Fowler's report describes folders that contained both adult and minor photographs, including teenagers and younger kids scraped from social media profiles, as restated by BiometricUpdate's coverage of the disclosure. The same consent gap applies, with the additional weight that a child's biometric exposure is permanent: a face a kid cannot change is a face they will be identifiable by for the rest of their life.
The downstream worry, flagged by Fowler and echoed in Malwarebytes' writeup of the disclosure, is training feedstock. A face-image corpus of this size, already labeled with identities and social-media handles, is the kind of dataset that face-recognition and identity-matching pipelines ingest. ClarityCheck has not been shown to have trained any model on the photos, and the company has not been linked in the reporting to AI-training operations. The risk is that an exposed corpus of unwilling-to-be-identified people can be consumed by actors outside the company that collected it.
The exposure also drew trade-press confirmation that this is a category, not an outlier. Security Magazine, 9to5Mac, and others are running the same Fowler-sourced findings. The next test of whether a people-finder has stored its photo corpus safely is now a routine question, not an unusual one.