www.biometricupdate.com ClarityCheck Exposes Millions of Facial Biometrics in Unsecured Database
Article Content
- •Over 9 million facial images were exposed in an unsecured Amazon S3 bucket.
- •ClarityCheck's misconfiguration also leaked personal information like email addresses and phone numbers.
- •The database was accessible for months before being secured after being reported.
Cybersecurity researcher Jeremiah Fowler discovered that ClarityCheck, a reverse-image lookup service, left over 9 million facial images accessible in an unsecured Amazon S3 bucket. The database, containing approximately 450.2 GB of data, included profile images and photographs of adults, teens, and children. Despite ClarityCheck's claims of privacy and security, the exposed data was accessible via URLs found in the company's website code. Additionally, misconfigured APIs exposed personal information such as email addresses and phone numbers. After being notified, ClarityCheck secured the database, but the exposure had been ongoing for months. Fowler emphasized the need for companies to treat biometric data as sensitive information. The incident highlights significant vulnerabilities in data handling practices within tech companies.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track ClarityCheck in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…