Privacy News 9 million images of people’s faces exposed by reverse lookup service

[Brownie2019]

Content source

https://www.malwarebytes.com/blog/privacy/2026/08/9-million-images-of-peoples-faces-exposed-by-reverse-lookup-service

Researcher Jeremiah Fowler found a cloud database containing more than 9 million image files accessible without authentication, WIRED reports.

The leaky bucket, containing some 450 GB of images, was traced back to a US-registered company called ClarityCheck.

In their own words, ClarityCheck says:

“Use reverse image search to identify anyone in a photo. Find names, social profiles, and online presence in seconds.”
While ClarityCheck says it does not use facial recognition, it does describe its image function as a way to identify people and find their names and social profiles.

Granted, there’s a difference.

• An image search looks for identical or visually similar images, often using image embeddings, metadata, or indexed pages.
• Facial recognition detects a face, derives face-specific features, and compares them to a structured, face-indexed collection of digital images.

But does that difference matter when your face gets uploaded and stored in an unsecured cloud environment?

It is important to remember here that faces are persistent identifiers. A leaked password can be reset, whereas a person cannot easily replace their face. When an image of someone is linked with names, social profiles, addresses, emails, or phone numbers, that information could potentially be misused for impersonation, targeted phishing, doxxing, or catfishing.

ClarityCheck disputed that the data was publicly exposed because accessing it required an unindexed URL. However, the images didn’t require authentication, and Fowler was able to discover the URLs through the site’s code.

It is unknown how long the bucket was exposed before Fowler found it. Despite earlier alerts from Fowler, ClarityCheck did not restrict access to the database until WIRED contacted the service in July.

People finder tools​

People finder tools are online services that aggregate public records, contact data, and social footprints to help locate individuals using names, phone numbers, emails, or addresses.

If you want to check whether someone on social media is using a fake or stolen profile picture because you’re worried they might be a scammer, a conventional reverse image search can help you see where else that picture appears online. You don’t need a people finder tool.

ClarityCheck, along with many others like it, requires users to confirm that they own the image, appear in it, or otherwise have the necessary rights and permission to upload it. Of course, a checkbox cannot prevent someone from lying.

There are a few pointers we want to give people who use ClarityCheck or similar tools:

• Do not upload a photo of someone else unless you have their permission or another clear legal right to do so.
• Think twice before uploading your own photo if you’re not sure how it’s going to be used, how long it will be stored, and how secure that storage is.
• Before using any service, check its policies on image retention, deletion, AI model-training use, storage, third-party sharing, and removing images.
• If you find yourself in a search result, save the URL and screenshots, request delisting from the search service, and seek removal from the original site or platform hosting the image.

---

Scammers don’t need to hack you. They just need you to click once.

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

 

[Bot]

The main risk is not only facial recognition—it is unauthorized collection and retention of identifiable images.

Even if a service performs only reverse-image matching, an image can still be associated with names, social profiles, contact details, or other personal information. An unauthenticated cloud storage location also creates risks such as bulk downloading, indexing, redistribution, and use in targeted scams.

The distinction between reverse-image search and facial recognition matters technically, but it does not eliminate the privacy impact. Facial images are difficult to replace, and combining them with other data can create a persistent identity profile.

The reported exposure also highlights an important security principle: an obscure or unindexed URL is not an access control. Sensitive files should require authentication and authorization, with appropriate logging, rate limiting, and protections against bulk enumeration.

For users:

• Avoid uploading images to services whose retention, deletion, sharing, and model-training practices are unclear.
• Do not upload another person’s image without permission or a valid legal basis.
• Use conventional reverse-image search cautiously when checking a suspicious profile, and avoid uploading private or sensitive photographs.
• If your image appears in a service’s results, preserve evidence and submit removal or delisting requests to both the service and the original hosting platform.
• Be alert for follow-up phishing or impersonation attempts after a photo or profile becomes publicly associated with your identity.

The broader lesson is that “publicly reachable” does not mean “secure,” and a checkbox asking users to confirm permission cannot substitute for technical safeguards or responsible data governance.