A reverse image search service called ClarityCheck, which claims to identify individuals from photos, exposed a database containing over 9 million image files, including photographs of faces. The exposed data, totaling approximately 450 GB, was stored in an unsecured Amazon S3 bucket, accessible online without authentication.
Independent security researcher Jeremiah Fowler discovered the exposure, noting that the files were organized in folders labeled "faces" and "profiles." The images included profile pictures, screenshots, and other photographs of adults, teenagers, and children. Fowler also identified a separate misconfiguration that exposed users' email addresses and phone numbers through manipulated website URLs.
ClarityCheck is a "people-finder" tool that offers searches based on phone numbers, email addresses, vehicle identification numbers, and names. Its photo-search feature purports to identify individuals in photos and locate their social media profiles. The company's website states that its reverse image search is "private and secure."
Fowler reported the issue to ClarityCheck, but initially faced difficulties. The company secured the image database and the API misconfiguration after being contacted by a news outlet in July. ClarityCheck stated that it acted immediately to restrict access once the issues were brought to the attention of the appropriate teams.
However, ClarityCheck disputed the characterization of the data as "publicly exposed," arguing that access required knowledge of a specific, unindexed URL not discoverable through ordinary use or general web searches. The company also claimed that the data included duplicate, cropped, and resized copies, along with non-image data, rather than 9 million unique images.
Security experts generally define data as exposed if it can be accessed by unauthorized individuals on the open internet without authentication. This includes misconfigured storage buckets or publicly reachable database backups.
The exposed images, particularly facial data, are considered highly sensitive biometric information. While ClarityCheck's website requires users to confirm they have permission to upload photos, Fowler noted that individuals whose faces were in the database might have been unaware their images were collected, especially since the service is designed for identification. Such data could be used for AI training or by scammers.
The email addresses and phone numbers exposed through the API misconfiguration were described by ClarityCheck as being sourced from publicly available information and licensed third-party data providers.
ClarityCheck has stated that it has improved its security reporting procedures to facilitate future communication with researchers. The incident highlights the risks associated with platforms that collect and analyze sensitive personal data, even with accidental misconfigurations.
