A “private and secure” face-search tool left 9 million photos exposed

ClarityCheck, a reverse-image search service, unintentionally exposed a 450 GB bucket containing more than 9 million face photos—including images of adults, teenagers and children—without any password protection, accessible via an unindexed URL found in its own website code. The same misconfiguration also allowed anyone to retrieve associated email addresses, phone numbers and physical addresses by altering certain web addresses, prompting the company to lock down the storage after being notified by researcher Jeremiah Fowler.