The people-search service ClarityCheck advertises on its website that "Your reverse image search is private and secure," but independent security researcher Jeremiah Fowler found the service left more than 9 million image files — including photographs of people's faces — publicly accessible in an unsecured Amazon S3 bucket, according to a WIRED investigation published August 19, 2026. A second misconfiguration exposed people's email addresses and phone numbers, WIRED reported.
The ClarityCheck service
ClarityCheck is one of a number of so-called people-finder tools that have appeared online in recent years, according to WIRED. These websites broadly claim to be able to search the web, public records, and other databases to identify individuals. ClarityCheck's website says it can run searches on phone numbers, email addresses, vehicle identification numbers, and names. Its photo-search page says it can help "identify anyone in a photo" and find social media profiles "in seconds."
The exposure in detail
Fowler's research uncovered roughly 450 GB of images, including what appeared to be profile images, screenshots, and other photographs of adults, teenagers, and children, according to WIRED. All of the images were stored in an unsecured Amazon S3 bucket, with files in folders named "faces" and "profiles," which could be accessed by anyone online through a URL included in the company's publicly available website code.
The findings, as reported by WIRED, are summarized below:
| Finding | Detail |
|---|---|
| Image files exposed | More than 9 million, including face photos |
| Total data volume | Roughly 450 GB |
| Storage location | Unsecured Amazon S3 bucket |
| Folder names | "faces" and "profiles" |
| Additional exposure | Email addresses and phone numbers |
| Access method | URL embedded in the company's public website code |
While ClarityCheck secured the giant image database after WIRED contacted the company in July, Fowler warned that it was seemingly exposed for months, and his initial efforts to flag the problem to the company were unsuccessful, WIRED reported.
ClarityCheck's response and the definition of 'exposed'
A spokesperson for ClarityCheck said in a statement to WIRED that the company appreciated Fowler's efforts to alert it about the issues: "Once this was drawn to the attention of the appropriate teams, we acted immediately to restrict access." However, the company disputed any characterization that the data was "exposed," arguing that an "ordinary member of the public" would not have come across it. "We do not accept that data in the temporary storage location was 'publicly exposed,' which implies large-scale public access," the spokesperson said. "Access required knowledge of a specific, unindexed URL that was not discoverable through ordinary use of the ClarityCheck service or a general web search."
The security industry broadly, as well as the US federal government specifically, considers data exposed if it could be accessed by people who are not intended to have access — particularly if it is reachable on the open internet without an authentication requirement, such as a username and password, according to WIRED. "Exposure is the state in which personal or sensitive data has been left accessible, discoverable, or otherwise put at risk of unauthorized access, whether or not anyone has yet taken or misused it," said Mark Beare, head of consumer products at the security company Malwarebytes. "A publicly reachable database backup, a misconfigured storage bucket, or credentials sitting in a system that a researcher can reach are all exposures."
Why exposed face images matter
Accidental data exposures create risk for any personal information, but particularly for sensitive and unchangeable biometric data like face images, according to WIRED. Fowler pointed out that while ClarityCheck's website requires people to attest that they have permission to upload photos, people whose faces were exposed may have had no idea that the company held their image. He told WIRED: "If you're trying to find out who a person is, you might not have authorization or permission, so people might not know that their image had been dumped into this database that was public. An AI bot could crawl it, extract faces, and use them for training. And there are lots of pictures of kids in there." WIRED also reported there is no suggestion of malicious access.
The enterprise takeaway
For enterprise technology decision-makers, the ClarityCheck incident illustrates a failure mode that can occur in any cloud environment: a misconfigured storage bucket, missing authentication, and a delayed response to researcher notifications. The additional risk posed by biometric data — which, as Fowler noted, can be harvested by an AI bot for training — makes the lesson more acute. Security vendors and the US federal government classify any accessible-but-unauthorized data as exposed, regardless of whether access requires a discovered URL or a direct public link. Organisations handling personal or biometric data should treat cloud storage configurations and authentication controls with the same rigor as the ClarityCheck case demands, according to the source reporting.
Sources:
