Overview
- Independent researcher Jeremiah Fowler found roughly 9,042,977 image files totaling about 450 GB stored in an unsecured Amazon S3 bucket that traced back to the people‑finder ClarityCheck.
- The files, kept in folders labeled “faces” and “profiles,” included profile photos, screenshots, and images of adults, teenagers, and children that were reachable via a URL embedded in the company’s public website code.
- ClarityCheck restricted access and said it fixed the storage and API issues after WIRED contacted the company, but the firm disputed that the data was broadly exposed because the bucket required knowledge of a specific unindexed URL.
- Researchers also reported misconfigured APIs that allowed names entered into URLs to return potential email addresses, phone numbers, and physical addresses until those endpoints were secured.
- Security experts warn the biggest harm is downstream: exposed biometric images cannot be changed and may have been crawled or copied for AI training, impersonation, catfishing, or targeted fraud, and the incident highlights recurring cloud misconfiguration risks in people‑finder services.