Reverse-lookup service exposed millions of photos of people’s faces
People-search service ClarityCheck left more than nine million images, including photographs of people's faces, publicly accessible online despite telling users their reverse image searches were "private and secure." Security researcher Jeremiah Fowler discovered the unsecured database, along with a separate misconfiguration exposing users' email addresses and phone numbers, raising concerns about how such "people-finder" tools handle sensitive biometric data that individuals often have no knowledge is being stored.
The exposed database, held in an unsecured Amazon S3 bucket, contained roughly 450 GB of images in folders labelled "faces" and "profiles", including photos of adults, teenagers and children, accessible via a URL embedded in the company's public website code. ClarityCheck secured the database only after being contacted by WIRED in July, though Fowler says it had likely been exposed for months and his earlier attempts to alert the company failed. ClarityCheck disputed that the data was genuinely "exposed", arguing that access required knowledge of a specific, unindexed URL not discoverable through ordinary searches, though security experts and the US government generally classify unauthenticated, internet-reachable data as exposed regardless of whether it was actively found.
- ClarityCheck exposed over 9 million face photos in an unsecured database
- Researcher also found leaked user emails and phone numbers
- Company disputes the data was truly "publicly exposed"
New here? Start with this
Reverse image-search services let people upload a photograph to look for matching images or information about the person in it. ClarityCheck is a people-search service that says its searches are private and secure; services like this may collect and store images without the people pictured knowing.
Photographs of faces can be sensitive because they can help identify people, including children. Security researcher Jeremiah Fowler found images in an online storage database, as well as a separate configuration that made some users’ contact details accessible.
The dispute over whether the database was “exposed” turns on what that means: ClarityCheck said its URL was not easy to find, while security experts generally consider data exposed if anyone can reach it online without signing in. The case raises questions about how people-search services protect the images and personal information they hold.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
ClarityCheck's exposure of millions of face photographs demonstrates why commercial biometric databases present unacceptable risks. The company falsely assured users searches were 'private and secure' whilst storing face images without meaningful consent, and only external pressure prompted action. Biometric data cannot be changed if compromised, making large-scale databases inherently dangerous for vulnerable people. Such collection should not be permitted, as the accumulation itself is the core problem.
The case against
Whilst ClarityCheck's conduct was seriously flawed, people-finder services provide legitimate value in locating missing persons and conducting background checks. The appropriate response is strict regulation rather than prohibition, including mandatory explicit consent, regular security audits, data minimisation standards, and meaningful penalties for breaches. ClarityCheck's failures reflect inadequate enforcement rather than proving the entire category cannot be regulated successfully. Similar systems operate under robust oversight elsewhere.