ClarityCheck Exposes 9 Million Face Images in Unsecured Database Leak
A US-based company, ClarityCheck, inadvertently exposed over 9 million facial images due to an unauthenticated cloud database, raising significant privacy concerns.
Researcher Jeremiah Fowler has uncovered a significant data leak involving a US-registered company named ClarityCheck, which exposed more than 9 million images of people's faces. The exposed data, amounting to approximately 450 GB, was stored in a cloud database that was accessible without any form of authentication. ClarityCheck's stated purpose is to "Use reverse image search to identify anyone in a photo. Find names, social profiles, and online presence in seconds." While the company claims it does not employ facial recognition technology, its service facilitates the identification of individuals and the retrieval of associated personal information.
The implications of such a leak are substantial, particularly given the persistent nature of facial data. Unlike a compromised password that can be reset, an individual's face cannot be easily changed. When images of faces are linked with personal identifiers such as names, social media profiles, addresses, or phone numbers, this information becomes a valuable asset for malicious actors. Potential misuses include impersonation, highly targeted phishing attacks, doxxing, and catfishing, all of which can have severe consequences for the affected individuals.
ClarityCheck has contested the severity of the exposure, arguing that access required an unindexed URL. However, security researchers like Fowler were able to discover these URLs by examining the site's source code, indicating that the data was not adequately protected. The duration for which the database remained exposed before discovery is currently unknown. Despite initial alerts from Fowler, ClarityCheck reportedly did not secure the database until media intervention, specifically when WIRED contacted the company in July.
Services like ClarityCheck, often categorized as people finder tools, aggregate public records and online data to help locate individuals. While reverse image search can be a legitimate tool for verifying profile pictures or identifying unknown individuals in photos, its misuse in conjunction with unsecured databases amplifies risks. The company requires users to confirm they have the rights to upload images, but this relies on user honesty and does not compensate for inadequate security measures.
This incident highlights a broader trend of data mismanagement and the inherent risks associated with storing sensitive biometric data. The ease with which such databases can be accessed, even through indirect means like examining website code, underscores the need for robust security practices, including proper access controls, encryption, and regular security audits.
For individuals using such services, caution is advised. It is crucial to consider the privacy implications before uploading personal photos or images of others. Understanding a service's policies on data retention, deletion, and third-party sharing is paramount. If one discovers their image or personal data exposed, steps should include saving evidence, requesting delisting from search services, and seeking removal from the original hosting platform.
The incident serves as a stark reminder that in the digital age, faces are unique and persistent identifiers. The security of databases containing such information must be a top priority for companies, as the potential for harm from their exposure is significant and long-lasting.