Security researcher Jeremiah Fowler discovered that people-search tool Clarity Check left over 9 million image files publicly exposed in an unsecured Amazon S3 bucket. The exposed database contained roughly 450 GB of photos, including profile images and screenshots of adults, teenagers, and children. Files were stored in folders named “faces” and “profiles,” accessible to anyone online via URLs found in the company’s public website code.

A second misconfiguration also exposed users’ email addresses and phone numbers. Clarity Check claims its reverse image search is “private and secure,” but Fowler’s findings suggest otherwise. After being contacted by WIRED in July, the company secured the database, though Fowler warns it had been exposed for months.

Biometric data like face images pose significant privacy risks since they cannot be changed. The service allows users to search phone numbers, email addresses, VINs, and names, and claims to identify people in photos and locate social media profiles. Fowler notes that individuals whose photos were exposed may not have known Clarity Check held their images, as the platform is designed for identifying others, not oneself.