9 Million Facial Images Exposed from ClarityCheck Reverse‑Lookup Service Due to Unauthenticated Cloud Bucket
What Happened — A researcher discovered that a publicly reachable cloud storage bucket owned by ClarityCheck contained roughly 450 GB of image files—over 9 million pictures of people’s faces. The bucket required no authentication; URLs were discoverable through the site’s source code. ClarityCheck only restricted access after media outreach.
Why It Matters for Compliance & Audit Readiness
- Unauthenticated data stores violate SOC 2 CC6.1 (Security) and CC6.2 (Privacy) requirements for logical access controls and data protection.
- The incident demonstrates the need for continuous evidence that image‑type personal data are encrypted, access‑logged, and retained only per documented policies—key audit artifacts for privacy‑focused SOC 2 engagements.
- Mapping this breach to Verisq’s CookiePLUS privacy capability shows how automated consent, DSAR handling, and retention controls can supply the defensible audit trail regulators expect.
Who Is Affected
- SaaS providers that host user‑generated visual content (e.g., reverse‑image search, people‑finder tools).
- End‑users whose facial images were uploaded, spanning consumer, media, and professional sectors.
Recommended Actions
- Immediately inventory all image repositories and enforce bucket‑level authentication and encryption.
- Conduct a privacy impact assessment (PIA) to verify compliance with GDPR/CCPA‑type obligations and SOC 2 privacy criteria.
- Update data‑retention and deletion policies; implement automated purge after a defined period.
- Capture access‑control logs and encryption proof as SOC 2 audit evidence.
- Deploy CookiePLUS to manage consent, track DSAR requests, and generate continuous compliance reports.
Technical Notes – The exposure stemmed from a misconfigured Amazon S3 bucket (or equivalent cloud object store) lacking IAM policies or public‑access blocks. No CVE is involved; the flaw is a configuration error. The data set included raw image files, some with embedded EXIF metadata linking faces to names, social profiles, and contact details. Source: Malwarebytes Labs