People-search tool ClarityCheck left a database containing more than 9 million image files — including photographs of adults, teenagers, and children — publicly accessible online, despite the company’s assurances that its reverse image search service is “private and secure.” The exposure was discovered by independent security researcher Jeremiah Fowler and reported by WIRED in August 2026.
The exposed database totaled roughly 450 GB and was stored in an unsecured Amazon S3 bucket. Files were organized in folders labeled “faces” and “profiles” and could be accessed by anyone with a URL that was embedded in the company’s publicly available website code. A second misconfiguration separately exposed users’ email addresses and phone numbers.
ClarityCheck is a people-finder service that claims to identify individuals using photos, phone numbers, email addresses, vehicle identification numbers, and names. Its photo-search feature advertises the ability to “identify anyone in a photo” and locate social media profiles “in seconds.”
Fowler says the database appeared to have been exposed for months, and his initial attempts to alert the company were unsuccessful. ClarityCheck secured the database after WIRED contacted the company in July 2026.
In a statement, a ClarityCheck spokesperson disputed that the data was truly “exposed,” arguing that access required knowledge of a specific, unindexed URL not discoverable through ordinary browsing or web searches. The security industry and the US federal government, however, broadly define exposed data as any personal information reachable on the open internet without authentication — regardless of whether it was actively misused.
Fowler highlighted particular concerns about the nature of the data. “An AI bot could crawl it, extract faces, and use them for training,” he told WIRED. “And there are lots of pictures of kids in there.” He also noted that people whose images were stored in the database may have had no knowledge that ClarityCheck held their photos, since the service is designed to identify people who may not have consented to being searched.
Source: WIRED