A Chinese facial-recognition database with information on thousands of children was stored without protection on the internet, a researcher discovered, raising questions about school surveillance and cybersecurity in China.

The cache was connected to a surveillance system labeled “Safe School Shield” and contained facial-identification and location data, according to Victor Gevers, a researcher at the Dutch nonprofit GDI Foundation, which scans the internet for vulnerabilities and flags them to owners for fixing.