Security researcher Jeremiah Fowler found a 450.2GB Amazon S3 bucket containing 9,042,977 face image files, split across two folders named faces and profiles. The bucket had no access controls at all, and the retrieval address was written directly into the front-end code of the provider's own website — anyone who got hold of the URL could download the whole thing. Ars Technica reported the leak on August 20.
The provider is ClarityCheck, a reverse face-search service: upload a photo, and the system scans facial landmarks, maps facial geometry, and matches it against images across the web, then produces a report that can include a name, address, and social media accounts — with more detailed reports available for a fee. The target audience is obvious: people trying to figure out who they're dating, or who's behind an anonymous account.
More than just faces leaked
A separate misconfiguration exposed email addresses, phone numbers, physical addresses, location history, and social media profiles. Fowler said the photos in the database included adults, teenagers, and children, and offered a blunt assessment:
"AI bots could crawl and scrape faces for training. There were a lot of photos of children there."
Unlike a password, a face can't be changed once it's exposed. A bank card can be reissued, a password reset — but facial geometry stays with a person for life. Once this kind of data is copied, it can end up being used for unauthorized identification, cross-platform tracking, or as material for fraud.
The company says this isn't exposure
ClarityCheck disputes the term "public exposure," arguing that ordinary members of the public couldn't have found the files, since access required knowing a specific, unindexed URL that wouldn't surface through normal use of the service or an everyday web search.
The problem is that the address was sitting in the company's own public-facing code. Security here depended entirely on "no one bothering to read the front-end source" — which is a very different thing from actually setting permissions. Mark Beare, head of consumer products at Malwarebytes, put it more plainly: exposure means sensitive personal data sits in a state that's accessible, discoverable, or at risk of unauthorized access.
The timeline doesn't look good either. The database was reportedly left open for months before it was locked down. Fowler's initial report to the company went unanswered, and the bucket wasn't closed until WIRED contacted the company in July.
A reckoning for the business model itself
Rebecca Williams of the American Civil Liberties Union pointed to the pattern itself: systems that rely on highly sensitive personal information to verify someone's identity carry these risks no matter how much data minimization or security hardening is layered on top.
That points to a structural contradiction that's hard to design around. A reverse face-search service's commercial value comes from the size of its image library — the bigger the library, the higher the match rate, and the more sellable the product. Scale is simultaneously the asset and the risk exposure, and the two grow together, which makes them difficult to pull apart with any single fix. Similar products in Europe have repeatedly drawn regulatory scrutiny over biometric data handling; in the US, aside from biometric privacy laws in a handful of states like Illinois, there's no unified federal constraint.
There's another layer for ordinary people here: most of the photos in this leak weren't handed over to ClarityCheck by the people in them. The uploaders are paying customers looking someone up, and the people being searched had no idea any of this was happening. That split between the data subject and the data provider makes "notifying affected users" practically unworkable.
Sources: Ars Technica, Malwarebytes Labs, CocoLoop, Biometric Update; the photo count and bucket size were cross-checked across multiple sources at 9,042,977 images and 450.2GB, and the company's response is quoted from its written statement to media.