Tobacco company got smoked by leaving secret recipes on a file share

When a pen‑tester walks into a tobacco firm’s network armed with Metasploit and comes out with a folder labelled “confidential” that actually contains the recipe for a cigarette, you know the security posture is as weak as a paper‑thin filter. That’s exactly what happened to a well‑known tobacco giant, and the fallout reads like a cautionary tale for any independent hosting provider or founder who thinks “we’ve got an AV” is a substitute for real security hygiene.

The “loud toys” that went unheard

Dahvid Schloss, a professional red‑team operator, started his engagement by firing off the usual loud‑mouth tools – Metasploit to probe for vulnerabilities and Nmap to map the network. He expected the company’s Trend Micro antivirus to at least flag the traffic. Instead, the product sat silent, like a machine‑gun blast in a sound‑proof room. Schloss himself likened the experience to “shooting a machine gun and having no one hear it.” That silence tells a bigger story: the endpoint protection was either mis‑configured or simply not tuned to detect the kind of scanning traffic that a pen‑tester generates.

For a hosting operation, this is a red flag. Relying on a single AV solution without layered detection – IDS, EDR, proper logging – is a recipe for missing the very activity that could be the first sign of a breach. The tobacco firm’s silence on the scan should have been a wake‑up call, but it was ignored, exposing the organization to deeper exposure.

Open SMB shares – the backdoor you never wanted

The real kicker came when Schloss turned his attention to file shares. Using Nmap, he spotted ports 139 and 445 open, the tell‑tale signs of Windows SMB services. While the share hosted sensitive IT and HR records, it also housed a folder named “confidential” that was completely open to any employee on the internal network. No authentication, no access controls – just a plain‑sight share that anyone could browse with Windows Explorer.

SMB is a notorious attack surface. In a production environment, you lock it down with segmentation, enforce least‑privilege, and monitor for anomalous access. The tobacco company’s failure to do any of that turned a routine internal share into a public ledger of trade secrets. For a founder running a data centre, the lesson is stark: never expose SMB shares without strict ACLs and monitoring, or you’ll hand attackers a low‑effort path to your crown jewels.

Trade secrets on a silver platter

Inside the “confidential” folder, Schloss found files named with the product name, sub‑product name, and date – each file detailing the exact weight, volume, and chemical percentages of a tobacco product. The documents were clearly marked “Confidential” at the top and “Do not share” at the bottom, a classic case of “security through labeling” that offers zero protection.

The fact that any employee could open Windows Explorer, navigate to the share, and read those files demonstrates a fundamental misunderstanding of data classification. Labels don’t stop data leakage; controls do. Independent hosting providers should treat any “confidential” tag as a cue to enforce encryption at rest, strict ACLs, and audit logs, not as a substitute for them.

Management’s denial – a classic cover‑up

After Schloss handed over his findings, the tobacco company’s security team flat‑out denied the existence of the files. They claimed the recipes were “not real” and that there was no security problem at all. Schloss’s manager even forced him to delete the downloaded copy of the file, effectively erasing the primary evidence he could have used to prove the breach.

This denial game is all too familiar in organisations that lack a mature risk culture. When a security issue is exposed, the instinct is to protect reputation rather than address the flaw. For founders, this is a warning: if your client or internal team reacts by denying or covering up findings, you’re dealing with a risk‑averse culture that will likely repeat the same mistakes.

What the year‑long dispute reveals

Schloss reported the incident and the security team continued arguing for a year, unable to produce the files because they had been deleted or moved. The prolonged dispute indicates a lack of proper incident documentation and change management. If the organization had a reliable version‑controlled repository or a robust audit trail, the existence (or removal) of the files could have been verified without a he‑said‑she‑said debate.

From a hosting perspective, this underscores the importance of immutable logging and change‑audit mechanisms. When you can prove that a file existed at a certain point in time, you eliminate the “it never happened” defence that many organisations use to dodge accountability.

Business risk and the cost of complacency

Leaking a tobacco recipe may not seem as catastrophic as a breach of credit‑card data, but the business impact can be severe. Trade secrets are a competitive advantage; their exposure can erode market share, invite regulatory scrutiny, and damage brand trust. The tobacco firm’s failure to protect such data exposes a broader risk: any “confidential” asset left on an open share is a liability.

Independent hosting providers often compete on price, but price alone won’t win the trust of clients who need to safeguard intellectual property. Demonstrating a hardened, layered security model – not just an AV subscription – becomes a differentiator. The cost of a breach, in terms of reputation and potential litigation, far outweighs the expense of proper segmentation and monitoring.

Actionable steps for founders

First, audit every SMB share. Close ports 139/445 on any system that doesn’t need them, and enforce strict authentication on those that do. Second, replace “security through labeling” with enforceable policies: encrypt confidential files, apply granular ACLs, and log every access attempt. Third, adopt a detection stack that goes beyond AV – think IDS/IPS, EDR, and centralized log aggregation – so that noisy tools like Metasploit trigger alerts.

Finally, cultivate a culture that welcomes findings instead of denying them. Require that any evidence presented by a pen‑tester be preserved, not destroyed, and that remediation steps are documented and tracked. When you treat security as a business risk, not an IT afterthought, you turn a potential smoking gun into a controlled, mitigated threat.

— Allan Ali, Founder

This article was produced with AI-assisted research and editorial support. Reporting is based on the source material cited below. Sources: The Register; theregister.com; Global1.News (06 November 2026).

By Allan Ali, Global1.News