2026 ClarityCheck — misconfigured S3; ~9M face/profile images + contact DB (WIRED/Fowler)
Data compromised
~9M image files (~450GB) including faces/profiles (adults/teens/children); separate exposure of emails and phone numbers per WIRED/Fowler
Technical writeup
WIRED reported (roundup window Aug 14–20, 2026; company contacted in July) that researcher Jeremiah Fowler found ClarityCheck left roughly 450GB / more than 9 million image files in an unsecured Amazon S3 bucket reachable via a URL in public site code, plus a second misconfigured database with emails and phone numbers. ClarityCheck told WIRED it restricted access after the issue reached the right teams; it disputed the “publicly exposed” framing while acknowledging remediation. Industry standard treats unauthenticated internet-reachable storage as exposure. recordsAffected uses the ~9M image-file figure; companyConfirmed true for the remediation acknowledgment.
Root cause
Misconfigured publicly reachable Amazon S3 bucket and secondary contact database (researcher disclosure)