The 7 Common File Sharing Mistakes in Business
By Simon Themiot - freelance cybersecurity consultant. Published May 22, 2026.
Summary
File sharing is an often underestimated leak surface. These seven mistakes recur in audits and can be reduced through simple rules, a suitable tool, and proper access management.
Mistake 1: Sending sensitive files as email attachments
Email is the universal reflex. But an email with attachment is: stored indefinitely in sender, recipient, and all intermediate (relay servers) mailboxes; not end-to-end encrypted (standard SMTP); impossible to revoke once sent; potentially accessible if a single account is compromised.
Solution: Use an E2E download link with expiration instead of an attachment.
Mistake 2: Using sharing links without expiration
A Google Drive or Dropbox link created in 2022 is probably still active in 2026. These "forgotten" links accumulate and constitute a permanent attack surface. If a single link leaks (browser history, compromised email, screenshot), the file is exposed without time limit.
Solution: Always configuré an expiration (1 day to 30 days maximum). A file that is no longer needed should no longer be accessible.
Mistake 3: Creating "anyone with the link" shares
The "anyone with the link" sharing on Google Drive, OneDrive, or Dropbox means anyone who obtains the URL can access the file. It is convenient, but it is the digital equivalent of leaving a confidential document on a park bench hoping no one will pass by.
Solution: Systematically add a password. Better: use an E2E service where the key is in the URL fragment (not transmitted to the server).
Mistake 4: Shadow IT - using unapproved tools
When the official tool is too complicated or slow, employees turn to personal services or accounts. IT then loses visibility into the DPA, recipients, retention, logs, and configuration, making compliance difficult to demonstrate.
Solution: Provide a secure tool as simple as WeTransfer. If the official tool is easy and efficient, employees are much more likely to adopt it.
Mistake 5: Not limiting the number of downloads
A sharing link without download limits can be used dozens of times without your knowledge. If the link leaks, it becomes a permanent and unlimited access to the file. A document intended for one person can end up downloaded by dozens of strangers.
Solution: Limit downloads to the expected number (1 to 5). The link expires automatically after this quota.
Mistake 6: Trusting "encrypted" without verifying the model
Many services advertise file encryption without always stating who manages the keys. Encryption at rest usefully protects media, backups, and snapshots, but it does not remove provider access when the application and keys remain under provider control.
Solution: Ask one question: "Who holds the decryption key?" If it is the provider, it is not E2E.
Mistake 7: No sharing traceability
In case of a security incident, the first question is: "who had access to what?" If you have no sharing logs (who sent what, to whom, when, and how many times the file was downloaded), it is impossible to measure a leak's impact and respect notification obligations (GDPR Article 33 - 72h to notify).
Solution: Use a tool that provides access logs: download date, download count, IP (if permitted). These logs are essential for incident response.
FAQ
How to convince management to invest in a secure tool?
Estimate the plausible incident cost: investigation, interruption, possible notifications, legal support, lost business, and remediation. Compare it with the total cost of the tool, rollout, and training. This produces a more credible case than claiming automatic ROI.
Do these mistakes concern SMEs or only large corporations?
SMEs may be more vulnerable when they lack a dedicated CISO or formal policy, though this is not universal. Security obligations apply regardless of size, according to processing and risk.
Related articles
Reduce these 7 risks
PrivCloud provides useful controls: optional E2E, configurable expiry, passwords, download limits, activity tracking, and temporary hosting in France. The tool complements internal policy and training; it does not eliminate shadow IT by itself.
Last updated: July 14, 2026.