Redbot Labs / Threat Intelligence
ClarityCheck Cloud Storage Exposure Reveals Millions of Facial Images
- Incident ID
- RBT-TI-0084
- Organization
- ClarityCheck
- Reported Location
- Claymont, Delaware, United States
- Severity
- High
- Category
- Data Exposure / Reverse Image Search
- Record Date
- 2026-08-19
Incident Summary
Security researcher Jeremiah Fowler identified publicly accessible cloud storage associated with ClarityCheck, a reverse-image search service.
The researcher reported approximately 9,042,977 files totaling 450.2 GB, including facial photographs.
The exposure highlights the privacy implications of accumulating searchable image collections. The reported file count does not represent a confirmed number of unique individuals.
What Happened
Publicly accessible storage
Fowler discovered a repository containing photographs in folders labeled “faces” and “profiles.” His sample included images of adults, teenagers, and children.
Disclosure and remediation
The researcher notified ClarityCheck, and the repository was restricted before publication. The exposure’s duration and whether unauthorized parties downloaded material remain unknown.
Separate API exposure
WIRED also identified a configuration issue allowing name-based requests to reveal potential contact information. Those URLs were subsequently secured.
Company response
ClarityCheck said the repository included duplicate and resized files, along with non-image data. The company disputed the exposure characterization because accessing the storage required an unindexed URL
Affected Systems
Reverse Image Search / Facial Image Repository / Uploaded Photographs / Profile Images / Contact Information Lookup API
Attack Vector
Cloud Storage Misconfiguration / Missing Access Controls / Data Exposure
Business Impact
Privacy and identity risks
Exposed photographs could potentially support impersonation, unwanted identity matching, or social engineering. These are potential consequences, not confirmed outcomes of this incident.
Uncertain affected population
Stored file totals should not be interpreted as unique victims. Multiple files can depict the same person, and the available evidence does not establish a definitive affected-person count.
Operational response
Organizations responding to this type of exposure may need to review access permissions, preserve logs, validate retention practices, and confirm that remediation covers both original images and generated copies.
Redbot Analysis
Image repositories require protection throughout the data lifecycle.
Redbot recommends evaluating how an application accepts, processes, stores, retrieves, and deletes images. Security testing should include original uploads, thumbnails, transformed copies, and associated metadata.
Application authentication does not establish storage security.
A website may require users to sign in while its underlying files remain directly accessible. Testing should verify whether unauthenticated visitors can retrieve stored objects and whether one account can access another account’s material.
Remediation should produce verifiable results.
Teams should document permission changes, repeat the original access test, examine available logs, and confirm that retained copies follow the intended deletion schedule. A monitored disclosure channel also helps researchers reach the people responsible for remediation.
The AI connection should remain clearly qualified.
This incident documents an image-data exposure. It does not establish an AI-driven attack or a compromised model. ClarityCheck’s disclaimer denies offering facial recognition despite its image-identification marketing; the technical implementation remains unverified.
