Security researcher Jeremiah Fowler discovered an unsecured database connected to people-search service ClarityCheck containing more than 9 million image files, many showing people’s faces. The database held about 450 GB of material and could be accessed without authentication through a storage URL exposed in the site’s public code. ClarityCheck restricted access after being notified and says there is no evidence that malicious actors downloaded the data.
The number needs some care: this was more than 9 million files, not 9 million confirmed individuals, because the collection included duplicate, cropped, and resized images. The more interesting issue is what those images represent. Faces, screenshots, profile photos, social-media images, and other personal pictures can now be searched, matched, manipulated, and reused with tools that are vastly more capable than they were a few years ago.
ClarityCheck is a people-search service that offers reverse searches using information such as names, phone numbers, email addresses, vehicle identification numbers, and photographs. Its reverse-image service allows a user to upload a picture and search for information that may help identify the person shown.
Fowler discovered a cloud-storage database linked to the service containing approximately 9,042,977 image files totaling 450.2 GB. In the sample he reviewed, folders labeled “faces” and “profiles” included profile pictures, screenshots, and photographs of adults, teenagers, and children. The storage location was not password protected and could be reached using a URL that appeared in ClarityCheck’s publicly available website code. Read Jeremiah Fowler’s original research
ClarityCheck disputed the description that the files were publicly exposed, arguing that an ordinary user would not encounter the unindexed URL through normal use or a web search. Security professionals generally use a broader definition: if information that should be restricted is reachable without authentication by someone who knows where to look, it is exposed. ClarityCheck restricted the database after being contacted and said it had improved its process for handling security reports.
WIRED also found a separate API configuration issue that could reveal possible email addresses, phone numbers, and physical addresses when names were inserted into specially constructed URLs. ClarityCheck said that information came from public sources and licensed third-party providers, and the company secured that route after WIRED raised the issue. Read WIRED’s investigation of the ClarityCheck exposure
There is currently no public evidence that criminals copied the exposed image database. This is therefore best described as a data exposure, rather than evidence of a successful data theft or breach by an attacker.
A photograph can look less sensitive than a password, Social Security number, or bank account. That comparison is becoming less useful as technology improves.
Faces are persistent. People can change passwords, replace payment cards, and create new email addresses; replacing the thing their friends, colleagues, cameras, social profiles, and identity systems use to recognize them is considerably less practical. A photograph can also become more valuable over time because future technologies may be able to extract or infer more from it than the systems available when it was originally collected.
ClarityCheck illustrates the point particularly well because identification is part of the service itself. WIRED tested the reverse-image feature using a reporter’s photograph and said the service described itself as scanning facial landmarks and geometry before looking for related images and information online. Its resulting report connected the photograph with a name, biography, online images, and other publicly available material.
A photograph therefore does not have to contain a name in the file for it to contribute to identification. It may become the starting point for finding the name.
That is worth remembering whenever organizations think about personal data purely as fields in a database.
There is another unusual aspect to this incident: some of the people pictured may never have interacted with ClarityCheck.
The service requires users to confirm that they have the right to upload an image. But a reverse-image service is often used precisely because the uploader does not know who somebody is. Fowler noted that the files he reviewed appeared to include material from social-media accounts, dating profiles, screenshots, and physical photographs, creating the possibility that people whose faces were stored had no idea that somebody else had submitted their photograph for analysis.
This illustrates a wider problem with the modern data economy. Your digital exposure is no longer determined entirely by what you choose to publish. Friends post photographs. Employers publish team pages. Schools and clubs share event pictures. Conference organizers upload galleries. Dating profiles get screenshotted. Images move between platforms and services, often long after the person depicted has lost any meaningful visibility into where they went.
For organizations, that matters particularly around executives, public-facing employees, customer-service teams, recruiters, salespeople, and anyone whose work creates a substantial online footprint. Personal information and imagery can become raw material for research, impersonation, pretexting, or social engineering without the employee ever doing anything obviously unsafe.
Our article The Psychological Perimeter: Human Risk, AI, and Cyber Resilience explores this wider change in the attack surface. Modern social engineering increasingly combines information from public sources, breaches, social media, synthetic media, and AI to build a much richer picture of the person being targeted.
There is no evidence that the ClarityCheck images have been used maliciously, so the potential risks should remain exactly that: potential.
The possibilities are nevertheless fairly easy to understand. A real photograph can make a fake social-media profile more convincing, support catfishing or impersonation, give an attacker material for AI-generated images or video, or help them research the relationships and online presence surrounding a particular person.
Fowler gives the example of a criminal selecting photographs and using AI to create convincing personas around them. Images could also be combined with names, contact information, company details, social profiles, or other OSINT to make an approach to colleagues or family members appear much more credible.
This is why the human-risk consequences of privacy exposure increasingly overlap with social engineering. The attacker does not necessarily need one perfect database containing everything. They can assemble fragments from several places until the resulting story looks authentic enough.
Cybermaniacs covers that problem in Social Engineering in the AI Era: Why Trust Is the New Battleground and Deepfakes, AI-Generated Phishing, and Machine-Led Scams. The underlying challenge is not simply that fake content is getting better. Attackers can now combine convincing synthetic content with very real information about the people they are impersonating.
Companies cannot realistically remove every employee photograph from the internet, nor would that be desirable for most organizations. Sales teams need profiles, executives speak at conferences, people collaborate publicly, and professional visibility is part of modern work.
The more sensible approach is to understand that publicly available does not mean harmless.
Employees should know that photographs, job titles, colleagues, personal interests, location clues, family information, conference appearances, and social-media history can all help an attacker build a pretext. That does not require frightening people into disappearing from the internet. It requires helping them understand how information can be combined and teaching stronger verification habits when an unexpected request arrives with an unsettling amount of accurate personal detail.
Organizations should pay particular attention to people whose roles make impersonation valuable. Executive teams, finance, HR, IT administrators, developers, communications teams, recruiters, and customer-facing employees may warrant additional guidance around synthetic identities, deepfakes, personal data exposure, and out-of-band verification.
Companies collecting photographs or other persistent identity information should apply the same discipline internally: collect only what is needed, understand where it is stored, restrict access, define retention periods, and make sure deletion promises correspond with actual storage behavior. Fowler reported seeing files with timestamps that appeared older than the retention period described by ClarityCheck at the time of his research, although an external researcher cannot determine the full lifecycle of individual files from timestamps alone.
Data minimization is not the most glamorous security control ever invented. It does have the attractive property that attackers cannot steal something you stopped keeping three years ago.
The ClarityCheck exposure is a useful example of how the definition of identity risk is expanding.
Cybersecurity programs have traditionally spent a great deal of time teaching people to protect credentials and personally identifiable information. That remains important, and our explainer on Personally Identifiable Information and why it matters covers the fundamentals. But identity now extends across a much richer collection of signals: our faces, voices, online histories, social connections, work roles, writing styles, locations, and the digital traces created by other people around us.
AI makes those fragments easier to find, connect, imitate, and operationalize. A photograph that once sat quietly on a forgotten profile may now help identify someone, find their other accounts, create a synthetic persona, or make an impersonation attempt look more plausible.
That does not mean employees should become paranoid about every photograph they have ever appeared in. It does mean cybersecurity awareness needs to catch up with the environment people are actually living in. Understanding digital footprints, OSINT, identity exposure, deepfakes, verification, and privacy is becoming part of basic cyber competency rather than an advanced topic for security specialists.
The face looking back from a photograph may be very human. The systems searching, matching, collecting, and repurposing it increasingly are not.
Cybermaniacs helps organizations build practical cyber competency around the threats people encounter at work and in their wider digital lives. Our Cyber Learning Experience delivers continuous, behavior-based learning on cybersecurity, privacy, social engineering, identity, AI-enabled threats, policy, and other risks that change much faster than an annual awareness course can reasonably accommodate.
We also help organizations understand the deeper human factors shaping cyber exposure through Human Risk Baselines, cyber-culture programs, managed phishing and social-engineering simulations, employee communications, champions programs, targeted campaigns, and HRM Advisory & Program Management. That broader Human Risk Management approach looks at competency alongside behavior, psychology, culture, organizational conditions, and the threat environment employees are operating within.
For organizations adopting AI, that increasingly includes helping the workforce understand how AI changes privacy, identity, deception, data handling, and trust. The goal is not to make people afraid of the technology or of their own digital lives; it is to give them enough understanding to make better decisions when the environment changes around them.
Security researcher Jeremiah Fowler discovered a cloud database connected to ClarityCheck that contained more than 9 million image files and could be accessed without authentication. ClarityCheck restricted the database after being notified.
Not necessarily. The database contained more than 9 million files, but ClarityCheck said these included duplicate, cropped, and resized versions of images. The number of unique people represented in the database is unknown.
There is no public evidence that an attacker hacked ClarityCheck or downloaded the exposed database. The confirmed issue is that the storage location was accessible without authentication. Determining whether anyone else accessed or copied the files would require internal access logs.
The researcher reported seeing profile pictures, screenshots, and other photographs showing adults, teenagers, and children. The images appeared in folders labeled “faces” and “profiles” and were associated with ClarityCheck’s reverse-image-search functionality.
Face images can potentially support identification, impersonation, fake profiles, OSINT research, social engineering, and AI-generated synthetic media. Unlike a password or payment card, a person cannot simply replace their face after it has been exposed.
Potentially, yes. Because users could upload photographs to search for the identity of another person, the individual shown in an image may not have been a ClarityCheck user or known that their photograph had been submitted.
Organizations can teach employees how attackers combine public and breached information, strengthen verification processes for consequential requests, provide additional support for high-risk roles, minimize unnecessary personal-data retention, and incorporate deepfakes, synthetic identities, privacy, and digital-footprint awareness into ongoing cybersecurity learning.