Nine million faces in an open bucket, and the vendor's answer was "the URL wasn't indexed"

Divide 450.2 GB by 9.1 million files and the average image works out at roughly 49 KB ^[18]. That is not a vault of high-resolution portraits; it fits what was reported in the store, profile pictures and screenshots ^[8]. Small files, but each one is the input side of a lookup: a photo someone pasted in to get back a name, social profiles and an online presence ^[1].

ClarityCheck's position, according to Malwarebytes' account, is that this was not a public exposure because reaching the files required an unindexed URL ^[9]. Unindexed and unreachable are different properties. Fowler obtained the URLs from the site's own code ^[9], which is the point at which obscurity stops being a control and becomes a description of how the storage was addressed. Nothing in the path asked for authentication ^[5].

The company also says it does not use facial recognition, while describing its image function as a way to identify people and find their names and social profiles ^[2]. For anyone whose photo is in the bucket, that distinction is a matter of internal architecture. What an attacker takes away is an image tied to a name, social accounts, and possibly an address, email or phone number, which is the raw material for impersonation, targeted phishing, doxxing and catfishing ^[13].

How long the store was open before Fowler found it is unknown ^[10]. That gap is the expensive part. Without a bounded window, nobody can scope who to notify or say whether a given face was copied, so there is no version of this incident in which the affected people get a clean answer. They were never the customers anyway; they were the query.

Fowler implies no wrongdoing by ClarityCheck and makes no claim of active exploitation, calling the risk hypothetical ^[15]. That caveat is worth keeping in view, because the failure on record is a storage decision rather than a theft. It is also the reason the story matters to anyone buying identity tooling: the same company sells reverse image search and identity verification ^[7], and the security floor under the verification data turned out to be an unlisted address. Fowler's own standard is the one to hold vendors to, which is that firms collecting facial biometric data should treat it as sensitive personally identifiable information and protect it accordingly ^[16].