InfoSecBulletin Cybersecurity for mankind
Cybersecurity researcher Jeremiah Fowler discovered a data leak in an AI image generator tool and informed ExpressVPN. The exposed database was unprotected and held over a million images and videos (1,099,985 records).
Jeremiah Fowler stated that during the investigation, most of the documents he reviewed were pornographic images, including AI-generated or manipulated images of young individuals. These included face-swapped pictures of adults and minors on AI-created bodies. More troubling was the presence of unaltered real images of individuals, likely uploaded without their consent.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
The database and its watermarked images were linked to a Silicon Valley company called SocialBook, which provides services for influencers and marketers, including AI tools for image and content generation.
During a review of SocialBook’s AI image-generation tool, it was found that it was linked to MagicEdit.app. This tool is available on the Apple App Store, credited to BoostInsider Inc., with support linked to socialbook.io and a copyright by “SOCIALBOOK.” While ownership details are unclear, MagicEdit seems connected to SocialBook, and BoostInsider might be a parent company or related developer. BoostInsider’s LinkedIn page lists offices in California, Beijing, Chengdu, and Shenzhen.
Jeremiah Fowler informed SocialBook and MagicEdit about a security issue, leading to the database being restricted from public access. He received a reply stating “Thank you for this responsible disclosure. We take this extremely seriously and we are conducting a full investigation into the scope of the exposure”.
MagicEdit is an AI-based image generation tool that allows users to turn text or pictures into various images, including adult content and face-swaps. The App Store notes that it’s for users over 18 and warns of potential sexual content or nudity.
Jeremiah Fowler suggests making social media profiles private to protect personal images from AI misuse, allowing only friends and family to view them. He also advises disabling public access to profile pictures and albums and regularly checking followers to limit who can see your content.
Laws now exist to help individuals facing sextortion or harassment by allowing the removal of nonconsensual images. In the U.S., The Take It Down Act (S.146), signed on May 19, 2025, criminalizes the publication or threat of nonconsensual intimate images, including AI-generated “deepfakes.”
