Reverse-Lookup Service Exposed Millions of Photos of People’s Faces
Security researcher Jeremiah Fowler discovered that ClarityCheck, a reverse-image people-search service, left more than 9 million image files — including facial photographs of adults, teenagers and children — publicly accessible online, despite the site's promise that searches are "private and secure." A separate misconfiguration also exposed users' email addresses and phone numbers. The exposure is particularly concerning because it involved biometric data, which cannot be changed once compromised, and because many people whose faces appeared in the database likely never knew they had been uploaded, given the service's purpose is to identify people without their involvement.
The roughly 450GB of images were stored in an unsecured Amazon S3 bucket, in folders labelled "faces" and "profiles", accessible via a URL embedded in the company's public website code. Fowler said the database appeared to have been exposed for months and that his initial attempts to alert ClarityCheck went unanswered; the company secured it only after WIRED made contact in July. ClarityCheck disputed that the data was genuinely "exposed", arguing the URL was not publicly discoverable, though security experts and the US government generally classify unauthenticated, internet-reachable data as exposed regardless of whether it was indexed or accessed.
- ClarityCheck left 9 million+ face photos publicly exposed online
- Unsecured S3 bucket also leaked emails and phone numbers
- Company disputes "exposed" label; secured data after WIRED enquiry
New here? Start with this
Reverse-image search lets someone upload a photo to find other images of the same person online. People-search services use this kind of matching to help identify people, often without asking the person in the photo.
A face is biometric information: unlike a password, it cannot simply be replaced if copied or misused. The images in a service’s database may also include people who did not know their photos had been collected, including children.
Online services often store files with cloud providers such as Amazon Web Services. Whether information counts as exposed can be disputed when it is reachable over the internet but not easy to find; the key issue is whether access controls prevent people without permission from viewing it.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Industry standards and government guidance classify unauthenticated, internet-accessible data as exposed, and this database met that definition for months. Biometric data cannot be changed once compromised, and millions of people whose faces appeared in the database likely never consented to its inclusion. The company explicitly promised privacy and security yet failed both; its delayed response to the researcher's alert compounds the concern.
The case against
Whilst the data was technically accessible, the URL required direct discovery via code inspection rather than search-engine visibility, significantly limiting practical risk. No evidence indicates that malicious actors accessed the data. The company operates a legitimate background-check service and remedied the issue once alerted. The distinction between theoretical accessibility and actual compromise is important when assessing real-world harm to affected individuals.