ClarityCheck Exposed Millions of Faces and Personal Data
A people-search service that promised privacy for image searches inadvertently exposed over 9 million photos, including faces, and personal data online.
The people-search tool ClarityCheck has exposed more than 9 million image files to the public internet, many of which appear to be photographs of people's faces. Independent security researcher Jeremiah Fowler discovered an unsecured Amazon S3 bucket containing approximately 450 GB of images, including profile pictures and other personal photos of adults, teenagers, and children.
In addition to the images, a separate misconfiguration publicly exposed users' email addresses and phone numbers. Fowler found that the images were stored in folders labeled "faces" and "profiles" and were accessible by anyone with a web browser.
ClarityCheck is among a growing number of people-finder services that have emerged online. These platforms claim to search the web, public records, and other databases to identify individuals. The service advertises its ability to perform searches using phone numbers, email addresses, vehicle identification numbers, and names, as well as to identify individuals in photos and find social media profiles quickly.
The incident highlights ongoing concerns about the privacy and security of personal data and images handled by online people-search services.