ClarityCheck exposed 9 million facial images in unsecured database
ClarityCheck, a facial identification and people-search service, left more than 9 million facial images and contact information publicly accessible in an unsecured Amazon S3 bucket for months. Security researcher Jeremiah Fowler discovered the exposure in July 2026, and the company secured access after being contacted. Most people whose images were exposed reportedly had no knowledge their photos had been uploaded to the service.
What happened
ClarityCheck stored more than 9 million image files totaling approximately 450 GB in an unsecured Amazon S3 bucket accessible to anyone online through a URL included in the company's publicly available website code. The files were organized in folders named 'faces' and 'profiles' and contained facial images of adults, teenagers, and children.
Reported impact
Security researcher Jeremiah Fowler found that the exposed images included facial photographs that appeared to be profile images, screenshots, and other photographs. Many images may have originated from third-party sources such as private profiles, social media accounts, dating app accounts, or were uploaded by third-party users without the knowledge of those pictured.
Fowler warned that the exposed photos and associated identities could be used by scammers to create fake social media posts or conduct fraud by impersonating individuals. He also noted that an AI bot could crawl the database to extract faces for training purposes.
Index analysis
ClarityCheck's website says the service can identify individuals in photos and find their social media profiles 'in seconds.' The website requires users to attest they have permission to upload photos, but Fowler noted that most people whose faces were exposed likely had no idea their images were in the database, as the service is explicitly designed for identification and people do not typically seek to identify themselves or those they know.
Governance controls
ClarityCheck's website claimed that uploaded reverse image searches were 'private and secure.' After WIRED contacted the company in July 2026, ClarityCheck said it 'acted immediately to restrict access' to the exposed data. Fowler's initial efforts to flag the problem to the company were reportedly unsuccessful before media contact.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.