It started with a simple request on a Tuesday morning.

Layla Hassan, a project coordinator at a mid-sized marketing firm, needed to share a campaign brief with an external design agency. Their usual process involved a clunky internal portal that required the agency to create yet another account. Frustrated by the delay, Layla's colleague, Tariq, offered a faster solution.

"Just change the sharing settings on the Google Drive folder to 'Anyone with the link,'" Tariq said, leaning over her monitor. "That way they can access it immediately. Everyone does it."

Layla hesitated for a moment, then clicked the dropdown and selected the option. The brief was shared, the agency was happy, and the morning moved on. What neither Layla nor Tariq realized was that the folder Tariq had pointed her to wasn't just the campaign brief. It was a parent folder — one that contained three years of client contracts, financial proposals, internal salary benchmarks, and a spreadsheet of employee personal data including national ID numbers.

For eleven days, that folder sat open to the internet.

The discovery came from an unlikely source. A junior analyst named Reem was doing a routine Google search for the company's name when she stumbled across a cached preview of a document that looked very familiar. It had their logo. It had client names she recognized. And it was sitting in a public Google index.

Reem's stomach dropped. She immediately walked to the IT security desk and placed her laptop in front of the security officer, Faisal.

"I found this while just searching online," she said quietly. "Is this supposed to be public?"

Faisal's expression shifted from confusion to alarm within seconds. He pulled up the Google Drive audit logs and saw what had happened. The folder had been set to public access eleven days ago. During that window, the access logs showed 47 unique external IP addresses had opened files — some of them multiple times.

The security team immediately revoked the sharing permissions and began an incident response process. But the damage assessment was grim. Among the exposed files was a spreadsheet used by HR containing the personal email addresses and phone numbers of all 200 employees. Within 48 hours of the folder going public, two employees had already received suspicious password reset emails for their corporate Microsoft 365 accounts — a sign that someone had harvested the data and was already attempting account takeovers.

One of those employees, a sales manager named Omar, had clicked the reset link before realizing something was off. His SaaS applications — including the company's CRM system — were accessed from an IP address in another country at 2:14 AM.

The breach had already begun.

In the emergency all-hands meeting that followed, the CISO walked the team through what had happened. The root cause wasn't a sophisticated cyberattack. It wasn't ransomware or a zero-day exploit. It was a dropdown menu clicked without understanding its consequences.

"This isn't about blame," the CISO said firmly. "This is about awareness. Every one of us interacts with cloud tools every single day. And every setting we change, every permission we grant, has a blast radius we need to understand."

Layla felt the weight of the moment, but she also felt something else — grateful that Reem had caught it at all, and determined that she would never click a sharing setting again without understanding exactly what she was opening and to whom.

The company spent the next two weeks forcing password resets across all SaaS platforms, enabling multi-factor authentication for every account, and auditing every shared Drive folder going back five years. Three external vendor folders were found with similar misconfigurations. The cleanup cost the IT team over 200 hours of work — all because of a single, well-intentioned shortcut.

Cloud tools are powerful precisely because they make sharing effortless. But effortless sharing is only one setting away from accidental exposure — and once data is out in the open, you can't unsee it, uncache it, or unsend it.