Home / Technology / Millions of Faces Publicly Exposed by People-Finder
Millions of Faces Publicly Exposed by People-Finder
19 Aug
Summary
- 9 million image files, including faces, were publicly exposed.
- Email addresses and phone numbers were also exposed by misconfiguration.
- Sensitive biometric data like face images carry significant risks.
A people-search website, ClarityCheck, experienced a significant data exposure incident, leaving approximately 9 million image files, including photographs of faces, publicly accessible. This unsecured data was stored in an Amazon S3 bucket and was discoverable through the company's website code. In addition to the images, a separate misconfiguration in the site's APIs led to the exposure of users' email addresses and phone numbers.
Although ClarityCheck has since secured the data after being notified in July, the security researcher who discovered the vulnerability warns that the exposure lasted for months. This incident underscores the heightened risks associated with biometric data like face images, which are immutable and highly sensitive. The company stated that the data was not "publicly exposed" in a broad sense, as access required knowledge of specific, unindexed URLs.
Concerns remain about the potential misuse of the exposed facial data, including its use for AI training or by malicious actors for scams and identity theft. The company has acknowledged the issue and stated it has improved its security reporting procedures. The exposed personal details were reportedly sourced from publicly available and licensed third-party data.
