Reverse-lookup service exposed millions of photos of people’s faces
Executive Take
This shows people-search and data-broker vendors often skip basic cloud security controls. Any company sending employee or customer data to third-party verification tools needs to audit those vendors now.
Executive Summary
Security researcher Jeremiah Fowler found that people-search service ClarityCheck left an unsecured Amazon S3 bucket exposed online, containing roughly 450GB and 9 million images of faces, profiles, and screenshots of adults, teens, and children. A separate flaw exposed users' emails and phone numbers.
Why It Matters
Technology and cybersecurity leaders should note that a vendor storing biometric-style face data left it open with no protection. HR leaders using background-check or identity-verification tools face real liability if their vendors have similar gaps.
Bizquad Perspective
The real risk isn't ClarityCheck alone, it's that dozens of similar people-search vendors likely have the same unsecured S3 setup and nobody is auditing them.