Anyone With the Link Can See It. Who Has the Link?

A Link You Sent Two Years Ago Still Works

Go test it. Search your sent mail for the word shared or for a drive.google.com or sharepoint.com link. Pick one from a year or two back. Open it in a private browsing window where you aren’t logged in.

If it opens, that file is available to every person who has ever had that link. The contractor you stopped working with. The employee who left in 2024. Whoever they forwarded it to. Anyone who read it in a group chat that’s still sitting on somebody’s old phone.

Nobody had to hack anything. You handed it out and then forgot.

Why This Is the Leak Nobody Sees Coming

Ransomware gets the headlines. Sloppy sharing is what actually leaks small business data, and it’s invisible because it doesn’t generate an alert. There’s no alarm, no locked screen, no ransom note. Just a file quietly readable by a group of people you can’t name.

What I typically find sitting in wide open links at small businesses:

• Payroll spreadsheets with names, pay rates, and sometimes full Social Security numbers
• Scanned driver’s licenses and voided checks collected during hiring
• Full client lists with contact info and contract values
• Bank letters and loan documents from the PPP era that nobody ever cleaned up
• A folder named Passwords. There is always a folder named Passwords.

Here’s the part that stings for a Florida business. If any of that includes personal information about Florida residents, you’re under the Florida Information Protection Act. A leak means notification obligations, and the Attorney General gets involved above 500 affected people. Your cyber insurance carrier is also going to ask how the data got out, and ‘we shared a link and forgot about it’ is a rough answer to give.

Anyone With the Link Doesn’t Mean What People Think

Most folks read that setting as ‘private but convenient.’ It really means ‘no login required, no record of who opened it, and no way to take it back except manually.’

Those links travel. They get pasted into Slack channels that contractors are still members of. They get forwarded to a personal Gmail so someone could read it at home. They sit in the mail archive of a laptop your former employee never returned. And if one ever gets posted somewhere public, a support ticket, a forum, a shared doc, it can get crawled and indexed.

The convenience is real. I’m not telling you to stop sharing files. I’m telling you that link sharing without an expiration date is a permanent decision you made in three seconds.

The Audit: About an Hour

If you’re on Google Workspace

Admin console, then Reports, then look at the file sharing activity and the Drive audit log. Filter for items shared externally or set to anyone with the link. In the Security section you’ll find a data protection view that flags externally shared files. Start with anything in HR, Finance, or Legal folders and work outward.

If you’re on Microsoft 365

SharePoint admin center, then Reports, then look at sharing activity. The Microsoft Purview compliance area shows you externally shared content across OneDrive and SharePoint. Sort by last activity date and go after the oldest links first, since those are the ones with the most drift.

If you’re on neither

If your team is running personal Dropbox and personal Google accounts to move company files, that’s the real finding. You cannot audit what you don’t administer. Getting onto a business tenant is step one and it costs about the price of a couple of lunches per person per month.

Change the Defaults So This Stops Happening

Auditing once is a cleanup. Changing defaults is the actual fix.

Set link expiration. Both Google and Microsoft let you force external links to expire after a set number of days. Thirty is a reasonable starting point. Make expiring the default and let people extend when they genuinely need to.

Default new links to specific people. Change the tenant setting so the sharing dialog starts on ‘specific people’ rather than ‘anyone with the link.’ Most users click whatever is already selected, which means the default setting is doing more security work than any training session ever will.

Require sign in for anything sensitive. Named recipients means you get a log of who opened it. Anonymous links give you nothing.

Share folders through groups, not individually. When somebody leaves, removing them from the group removes their access everywhere at once. Individual shares are the ones you’ll miss.

Use view only unless editing is the point. Also turn off download for genuinely sensitive documents. It’s not perfect (people can screenshot) but it stops the casual copy walking onto a personal laptop.

Stop emailing sensitive documents entirely. If a client needs to send you a scanned ID, use a secure upload link instead of an email attachment that will live in two mailboxes forever.

Then Delete the Stuff You Shouldn’t Have

Half of what’s over shared shouldn’t exist anymore. The 2021 tax documents for an employee who left in 2022, the scanned checks from a vendor you no longer use, the client list from a business line you shut down. Data you deleted can’t leak. Set a retention rule, delete what’s past it, and shrink the target.

Try the Private Window Test Tonight

Seriously, that’s the whole assignment. Open a private window, paste in an old link you sent, and see what a stranger sees. It takes two minutes and it tends to change how a business owner thinks about the share button.

If you’d rather have someone run the full audit and lock down the defaults for you, that’s a normal engagement for us. We do it for businesses from Delray Beach to West Palm Beach, and you get a report of exactly what was exposed and what changed. Always happy to troubleshoot.