ClarityCheck leaves over nine million facial images exposed in unsecured cloud storage
A security researcher found that ClarityCheck stored more than nine million face photos in an unprotected cloud bucket, making them publicly accessible.
Cybersecurity analyst Jeremiah Fowler uncovered that ClarityCheck, a paid reverse-image and personal-data lookup platform, kept 9,042,977 photographs of individuals in an unsecured cloud storage bucket. The images—covering adults, teenagers and children—were publicly reachable until the company restricted access in July following a report. ClarityCheck advertises its services in more than 20 languages, charging Canadian visitors $1.69 for a trial and $38.99 per month thereafter, but the exposed files are not customers’ uploads; they are subjects of prior searches.
The firm claims the data consists largely of duplicate or resized copies and that access required knowledge of a specific unindexed URL. Privacy scholar Teresa Scassa noted that Canadian law obliges companies to protect such personal information and that individuals can request deletion, though enforcement would depend on U.S. courts. The breach underscores the dangers of services that collect facial images without strong consent safeguards.
Why it matters
Unprotected facial images can be exploited for fraud, stalking, or other privacy violations.
In this story
