A cloud database containing over 9 million image files, primarily of people's faces, was found to be publicly accessible without authentication. The unsecured data, totaling approximately 450 GB, was identified by researcher Jeremiah Fowler and linked to ClarityCheck, a U.S.-registered company offering a reverse image lookup service.
ClarityCheck describes its service as a tool to "identify anyone in a photo" and "find names, social profiles, and online presence in seconds" using reverse image search. While the company states it does not employ facial recognition technology, its functionality aims to link images of individuals to their online identities. Reverse image search typically identifies identical or visually similar images using methods like image embeddings or metadata, whereas facial recognition analyzes specific facial features for comparison against indexed collections.
The exposed database contained images that, if linked with personal data such as names, addresses, emails, or phone numbers, could facilitate various forms of misuse including impersonation, targeted phishing, doxxing, or catfishing. Unlike a compromised password, which can be reset, a person's face serves as a persistent identifier.
ClarityCheck initially contended that the data was not publicly exposed because access required an unindexed URL. However, Fowler was able to discover these URLs by examining the service's website code, and no authentication was required to access the images. The duration of the database's exposure before Fowler's discovery remains unknown.
Despite earlier notifications from Fowler, ClarityCheck reportedly did not secure the database until July, following an inquiry from a news outlet. Services like ClarityCheck often require users to confirm they have the necessary rights or permissions to upload images, though this mechanism does not prevent users from providing false information.
Such "people finder" tools aggregate public records, contact information, and social media data to help locate individuals. While conventional reverse image searches can verify if a social media profile picture is authentic, services like ClarityCheck go further by aiming to identify the individual. Users are advised to exercise caution when uploading photos, particularly those of others without explicit permission, and to review a service's policies regarding image retention, deletion, AI model training, storage, third-party sharing, and removal options. If an individual finds their image in search results, they can request delisting from the search service and removal from the original hosting platform.
