Tobacco company got smoked by leaving secret recipes on a file share
Tobacco company's secret recipes exposed on an unsecured file share during a penetration test.
During a penetration test, a security researcher discovered a tobacco company's secret product recipes stored on an unsecured internal file share. The files, marked 'Confidential' and 'Do not share,' contained detailed manufacturing information. The company initially denied the data was real, but later removed it, suggesting the exposure was indeed genuine.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Trend Micro?
Get an email when a new story names Trend Micro, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA tobacco company's most sensitive intellectual property — detailed product recipes marked 'Confidential' and 'Do not share' — was left openly accessible on an internal file share with no meaningful access restrictions. This is a classic case of labelling data correctly but failing to enforce the controls that the labels imply, rendering the classification effort meaningless. The exposure was only discovered during a third-party penetration test, meaning it could have been silently exploited by an insider or attacker for an unknown period beforehand. The company's initial denial of the breach further highlights a weak incident-response posture and poor asset awareness. Sensitive intellectual property exposed in this way can cause irreversible competitive, legal, and reputational damage.
What helps against this
How we list vendors- Penetration testing and bug bounty
Someone friendly finds the holes before someone hostile does.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.