ClarityCheck left 9 million facial recognition images exposed
What happened
A reverse image search and identity verification service left a 450 GB database of about 9 million facial and profile images publicly accessible, including images of children. The researcher reported it and the database was secured.
ClarityCheck is a people-search service that lets users upload a photo, phone number or email address to find out who someone is. Researcher Jeremiah Fowler found about 450 GB of its files in an Amazon S3 storage bucket that needed no password and was not encrypted; the bucket's address could be found in the company's own public website code. The files were mostly faces, stored in folders named faces and profiles, and included profile photos, screenshots and pictures of adults, teenagers and children, some apparently taken from social media and dating sites. Because the service identifies people from photos other users upload, many of those pictured are unlikely to know their image was stored. Fowler said the data appeared to have been exposed for months and was kept longer than the 14 days the service promised. WIRED separately reported a lookup setting that could return people's email addresses, phone numbers and home addresses.
How it happened
Leaky AI product: Exposed datastore. A database, storage bucket or server behind an AI product was left open on the internet without a password.
Sources do not say whose AI model was involved. The product was ClarityCheck, a type of AI-powered app.
Impact
Data was exposed. Data involved: personal data. The impact was confined to one organization and its users or customers. Sources give a figure of 9,042,977.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 19 Aug 2026.
ClarityCheck restricted access after being contacted, and fixed the separate lookup issue after WIRED raised it. The company disputed that the data was publicly exposed, arguing it needed an unindexed web address to reach, and said the file count included duplicate and resized copies.