Lily Hay Newman Matt Burgess Security Aug 19, 2026 6:00 AM Reverse-Lookup Service Exposed Millions of Photos of People’s Faces The people-search tool ClarityCheck says its reverse image search service is “private and secure”—but it left a database containing more than 9 million image files exposed. Photo-Illustration: Jobanny Cabrera; Getty Images Save this story Save this story When someone uploads a photo to the people-search tool ClarityCheck, the website has a clear message: “Your reverse image search is private and secure.” New research , though, shows that the website left more than 9 million image files, including photographs of people’s faces, publicly exposed . And a second misconfiguration publicly exposed people’s email addresses and phone numbers. Overall, according to findings from independent security researcher Jeremiah Fowler, the exposed ClarityCheck database contained roughly 450 GB of images, including what appeared to be profile images, screenshots, and other photographs of adults, teenagers, and children. All of the images were stored in an unsecured Amazon S3 bucket, with files in folders named “faces” and “profiles,” which could be accessed by anyone online through a URL included in the company’s publicly available website code. ClarityCheck is one of a number of so-called people-finder tools that have appeared online in recent years. These websites broadly claim to be able to search the web, public records, and other databases to identify individuals. ClarityCheck’s website says it can run searches on phone numbers, email addresses, vehicle identification numbers, and names. Its photo-search page says it can help “identify anyone in a photo” and find social media profiles “in seconds.” While ClarityCheck secured the giant image database after WIRED contacted the company in July, Fowler warns that it was seemingly exposed for months, and his initial efforts to flag the problem to the company were unsuccessful. Accidental data exposures create risk for any personal information, but particularly for sensitive and unchangeable biometric data like face images. And while ClarityCheck’s website requires people to attest that they have permission to upload photos to its site, Fowler points out that in practice, people whose faces were exposed may have had no idea that ClarityCheck held their image. After all, he notes, the service is explicitly designed for identification, and people don’t typically seek to identify themselves or people they know. “If you’re trying to find out who a person is, you might not have authorization or permission, so people might not know that their image had been dumped into this database that was public,” Fowler tells WIRED. “An AI bot could crawl it, extract faces, and use them for training. And there are lots of pictures of kids in there.” In a statement sent to WIRED, a spokesperson said that ClarityCheck appreciated Fowler’s efforts to alert the company about the issues. “Once this was drawn to the attention of the appropriate teams, we acted immediately to restrict access,” the spokesperson said. The company disputed any characterization that the data was “exposed,” saying that an “ordinary member of the public” would not have come across it. “We do not accept that data in the temporary storage location was ‘publicly exposed,’ which implies large-scale public access,” the spokesperson says. “Access required knowledge of a specific, unindexed URL that was not discoverable through ordinary use of the ClarityCheck service or a general web search.” The security industry broadly, as well as the US federal government specifically, considers data to be exposed if it could be accessed by people who are not intended to have access—particularly if it is reachable on the open internet without being protected by an authentication requirement, such as a username and password. “Exposure is the state in which personal or sensitive data has been left accessible, discoverable, or otherwise put at risk of unauthorized access, whether or not anyone has yet taken or misused it,” says Mark Beare, head of consumer products at the security company Malwarebytes. “A publicly reachable database backup, a misconfigured storage bucket, or credentials sitting in a system that a researcher can reach are all exposures.” “There is no suggestion of malicious access, as the researcher notes,” the ClarityCheck statement continued. “The data involved includes duplicate, cropped, and resized copies of the same files, along with non-image data, not 9 million unique images.” The company added that it has “improved” its security reporting procedures to help other researchers contact the company in the future. In addition to the face data, ClarityCheck had also misconfigured its APIs such that its website URLs could be manipulated to reveal data about people simply by entering names; anyone using any consumer browser could have done this. Entering a name into one of the URLs would return multiple potential email addresses, physical addresses, and phone numbers for people with that name. After WIRED contacted the company, the URLs were secured. The ClarityCheck spokesperson said in the statement that the details displayed were “sourced from publicly available information and licensed third-party data providers.” ClarityCheck’s face-search feature allows people to upload an image and then receive a “report” about where that image may appear online and who may be shown in the photo. When a WIRED reporter tested the system using their own face image, the website said it was “scanning facial landmarks” and “mapping unique face geometry” before matching the image to others online and offering a report that could include a full name, addresses, location history, public appearances, photos, videos, social media profiles, and “hidden dating profiles” for a fee. The resulting report named the reporter, provided a biography, and linked to multiple photos of them online. Misconfigurations and accidental exposures are unfortunately common online, but as digital platforms offer more and more automated capabilities for collecting and analyzing sensitive personal data, the stakes grow ever higher for securing information. “Systems that rely on highly sensitive personal information to verify individuals will continue to carry these risks, even with stronger data minimization and security practices, because the model itself depends on collecting sensitive data,” says Rebecca Williams, director of strategy for privacy and data governance at the American Civil Liberties Union. Fowler emphasizes that exposed data, including photos , are more valuable than ever to scammers or cybercriminals. “Let’s say I was in a criminal outfit and I was catfishing people, and I scroll through all these pictures and I pick out 20 of the most attractive people and then I just use their image and AI and I create a persona,” Fowler says. Comments Back to top Join the discussion Comments Back to top You Might Also Like In your inbox: This is not your average politics newsletter WiFi-8 is coming—here’s everything you need to know Big Story: Young runners are becoming freakishly fast The new reality of urban surveillance Take our survey: Do you work in tech? We want to hear from you Lily Hay Newman is a senior writer at WIRED focused on information security, digital privacy, and hacking. She previously worked as a technology reporter at Slate, and was the staff writer for Future Tense, a publication and partnership between Slate, the New America Foundation, and Arizona State University. Her work ... Read More Senior Writer Matt Burgess is a senior writer at WIRED focused on information security, privacy, and data regulation in Europe. He graduated from the University of Sheffield with a degree in journalism and now lives in London. Send tips to [email protected] . ... Read More Senior writer Topics data breaches privacy face recognition leaks security cybersecurity databases Read More Flock Has a Powerful New AI Tool for Police. We Got Its Code Flock’s surveillance cameras have already sparked outrage. WIRED reconstructed its next-generation AI system, already in use by some police, to confirm it goes much further than tracking license plates. Dhruv Mehrotra CBP Workers Allegedly Used Government Databases to Spy on Exes, Crushes, and Colleagues Records obtained by WIRED detail hundreds of allegations of Customs and Border Protection workers misusing internal tools to look up romantic interests and track colleagues’ cell phones. Yulia Almazova Meta Ran Ads That Contained AI-Generated Child Sexual Abuse Imagery More than 50 offending image and video ads were published across Facebook, Instagram, Messenger, or Threads, according to Meta’s ad library data. Some ran as recently as this week. Matt Burgess OpenAI’s Browser Could Be Hijacked to Spam Your WhatsApp Contacts Researchers at security firm Zenity found more than a dozen flaws in AI browsers—and managed to get OpenAI’s Atlas to make an unauthorized Amazon purchase. Matt Burgess Sensitive Info Goes Into ‘No Reply’ Emails Constantly. This Guy Sees It All Two security researchers bought cheap domains—including noreply.net and deleteduser.com—and set up email listening services. Hundreds of companies are sending them corporate secrets. Matt Burgess Hackers Stalked Me by Hijacking a Smartwatch for Kids Security researchers tracked and eavesdropped on a WIRED reporter using vulnerabilities in a pink plastic smartwatch. It’s just one piece of a deeply insecure supply chain of GPS-enabled gadgets. Andy Greenberg Hugging Face Has a Deepfake Nudes Problem Researchers tested top image editing models on Hugging Face and found they could easily create explicit deepfakes—and 1,000 image editing prompts show how people use the software. Matt Burgess A Security Pro Hacked North Korean Hackers. He Found They’d Breached Hundreds of Networks Worldwide For nearly two years, researcher Vangelis Stykas has mainta