Tobacco company got smoked by leaving secret recipes on a file share

A penetration tester hired to assess a tobacco company’s network found that its defenses appeared ineffective: Trend Micro antivirus raised no alarm while he used conspicuous tools to scan for vulnerabilities. Seeking a risk that would matter directly to the business, he looked for exposed file shares. One share had no access controls, despite containing sensitive IT and human-resources records. Network scans showed Windows SMB file sharing on ports 139 and 445, and the tester could browse the files using ordinary Windows Explorer.

Inside a directory marked “confidential,” he found files labeled as product recipes, with names and dates matching the company’s products. A file described manufacturing details, including quantities and the proportions of chemicals used; it was explicitly stamped confidential and not for sharing. He downloaded a copy to demonstrate the exposure, then deleted it at his manager’s instruction because of its sensitivity. When he reported the discovery, the company’s security staff insisted the files were not genuine and denied a problem. The dispute continued for about a year, leaving the tester unable to prove what he had seen. Near the end of the engagement, he checked again and found the files had disappeared, suggesting they had been deleted or moved. The episode highlights both careless access control and how destroying evidence can make an organization’s denial difficult to challenge.