On October 16, 2026, the California Department of Education published its notice about a breach at Educational Testing Service, the company that runs the state's student testing. The system involved was not a forgotten FTP box. It was an SFTP site, the kind most people would call the secure option. According to the state's incident notice, an unauthorized party used a compromised login credential to get in and copy files at various times between May 22 and September 18, 2026. ETS identified the activity on September 25, disabled the account, took the site offline, and built a new one with stronger controls.
The protocol did its job. It encrypted the traffic. That is the point most people miss about secure file transfer for business: the protocol name matters far less than the settings around it. What failed was everything around it: a single password standing guard, months of copying that nobody flagged, and records kept long after they were needed. We covered the family side in our post on the California student data breach. This article is for the business owner who still has an old FTP server in the closet, or a OneDrive link from 2021 that still opens for anyone who has it.
Why old FTP servers and forever links are still everywhere
Plain FTP dates from the early internet and sends usernames, passwords, and file contents across the network unencrypted. It survives because it works and because some partner, printer, or piece of software was set up to use it a decade ago. Architects send drawing sets to it. Accounting firms collect tax documents through it. Medical offices receive lab files from it. Nobody wants to be the person who breaks the workflow, so the server stays on and the firewall port stays open.
Forever links are the modern version of the same habit. Someone shares a folder with "anyone with the link," the project ends, and the link keeps working for years. It gets forwarded, pasted into a vendor's ticket system, or saved in an old email thread that later gets compromised. Law firms meet this problem in discovery and client intake, which we cover in our guide to secure file sharing for law firms, but every business that exchanges documents has some version of it.
What the ETS breach teaches about "secure" file transfer
Three lessons carry straight over to a 20 person office. First, encryption in transit does nothing if the attacker holds a working login. A transfer site guarded only by a password is one phishing email, one reused password, or one infected home computer away from being opened. Second, a transfer account that suddenly copies large amounts of data on an unusual schedule should raise an alarm in days, not months. Third, files that stay on a transfer server after delivery are files waiting to be stolen.
There is a fourth lesson from earlier incidents. Dedicated transfer products are internet facing software, and attackers hunt them. A joint CISA and FBI advisory describes how the CL0P ransomware group began exploiting a previously unknown SQL injection flaw in Progress Software's MOVEit Transfer on May 27, 2023, after earlier campaigns against Accellion's file transfer appliance and Fortra's GoAnywhere MFT. Whatever you run, it needs fast, disciplined patch management.
Three secure file transfer options, and which business each one fits
If your office already uses Microsoft 365, the best answer for people sharing documents is already paid for. It lets you share files from SharePoint and OneDrive with specific people, set links to expire, block downloads on sensitive items, and see who opened what. Clients and vendors sign in with their own account or a one time verification code. If you are unsure where shared files should live, our comparison of SharePoint vs OneDrive sorts out team files from personal ones.
SFTP still makes sense for automated transfers between systems, such as payroll files to a bank, claims to a clearinghouse, or nightly exports to an outside vendor. Done properly, each partner gets its own account locked to its own folder, signs in with a cryptographic key instead of a password, and connects only from known IP addresses. OpenSSH, the most common SFTP server software, can require two methods in a row through its AuthenticationMethods setting, for example a key followed by a password, so one stolen secret is not enough.
Managed file transfer platforms add workflows, guaranteed delivery, and detailed audit trails for organizations with many partners and compliance reporting needs. They earn their cost at scale, but remember the MOVEit lesson. A platform exposed to the internet has to be patched within days of a critical fix, and someone has to own that job by name.
The SFTP security and sharing settings that matter more than the tool
Expiring links come first. In the SharePoint admin center, an administrator can require all "Anyone" links to expire within a set number of days and limit them to view only. Microsoft's sharing settings documentation notes that shortening the limit also shortens existing links, which makes it a fast way to retire years of forever links. Set the default link type to specific people, set guest access to expire automatically, and restrict external sharing to approved partner domains where that fits your business.
Multifactor sign in comes second, on every account that can reach shared files, including guest and service accounts. For administrators and anyone handling bulk data, move toward phishing resistant MFA, because a code typed into a fake page can be relayed as easily as a password.
Logging comes third, and it is the setting most often missing. Microsoft states that audit logging is not turned on by default for Business Basic, Business Standard, and Business Premium, so many small tenants have no record of file activity at all. Turn it on, keep it, and alert on unusual download volume. For SFTP, send server logs somewhere the attacker cannot erase them.
Retention closes the loop. Transfer folders should empty themselves on a schedule, partner accounts should be disabled when the relationship ends, and departing employees should lose access the same day, as covered in our employee offboarding guide.
Where you handle Social Security numbers or medical records, data loss prevention rules can stop those files from being shared externally at all.
A 30 day plan to retire old FTP and forever links
Spend the first week finding everything. Check the firewall for open FTP and SFTP ports, list every account on any transfer server, and run a sharing report in Microsoft 365 to see how many links allow anyone access. In the second week, set the organization rules: link expiration, view only defaults, guest expiration, and multifactor sign in for every user. Turn on audit logging the same day.
Use the third week to move partners. People who exchange documents by hand move to Microsoft 365 sharing with specific people. Systems that exchange files automatically move to SFTP with keys and IP limits. Give each partner a firm date. In the fourth week, shut off plain FTP, close the port, delete stale accounts, and write a one page standard so the next project starts the right way.
How GlobeVM helps
GlobeVM has spent 30 years building and securing networks for Los Angeles businesses, and we support more than 75 organizations across Southern California. Firewall management, endpoint protection, email filtering, and multifactor sign in are standard in every plan, and we watch systems 24/7. Our cloud security services cover the work in this article, from finding forgotten FTP servers and stale links to tightening Microsoft 365 sharing settings and setting up key based SFTP for partners who need it. When you call, a person in Los Angeles answers in under 15 minutes, often George or Nazy, the owners, in English or Farsi.
Call (818) 405-9930 or request a free IT assessment, and we will show you every door your files can leave through.