Reverse-Lookup Service Exposed Millions of Photos of People’s Faces

Researcher Jeremiah Fowler discovered that people-search service ClarityCheck left roughly 9 million image files (about 450 GB) and a separate dataset of emails and phone numbers publicly accessible in an unsecured Amazon S3 bucket. The exposed content included profile photos and face images — including children — stored in folders named “faces” and “profiles,” accessible via URLs embedded in the site code; the company secured the data after being contacted, but the prolonged exposure raised privacy and biometric misuse concerns, including potential AI training or unauthorized identification.