The Online Storage Mistakes That Put Small Firms at Risk

Small firms keep everything in the cloud now: contracts, invoices, client records, payroll. That makes storage one of the biggest single points of failure in the business, and the numbers back it up. The UK government’s Cyber Security Breaches Survey found that 43% of businesses, around 612,000 across the country, reported a breach or attack in the past year, and small businesses actually went backwards on basics like risk assessments and continuity planning.

Most of these incidents don’t start with a clever hacker. They start with a sloppy habit that nobody has looked at in years. Here are the storage mistakes that do the most damage to small firms, starting with the one almost everyone is guilty of.

Mistake #1: You Share Links That Never Expire

The quick share link is the most convenient feature in cloud storage, and the most abused. Someone needs a file, you generate a link, you paste it into an email and move on. That link often grants access to anyone who has it, and it stays live long after the project ends. Links get forwarded, pasted into group chats and left in old email threads that later get compromised.

Most online storage services let you put an expiry date and a password on a shared link, yet in most small firms those settings go completely untouched. A link created for one client in 2023 can still be opening a folder of financial documents today. So, make sure to set expiring, password-protected links as your default, and run a quarterly sweep of everything currently shared. You’ll usually find dozens of live links nobody remembers creating.

Mistake #2: Your Whole Business Lives in One Personal Account

Plenty of firms started life in a founder’s or early employee’s free personal account. The business grew, the folder structure grew with it, and five years later the entire company archive belongs to one individual login. If that person leaves, falls out with the owners or simply forgets the password, the firm has a serious problem.

An ex-employee walking out with admin control over every client file is also a data protection incident waiting to happen. Move everything to a proper business account where the company owns the data, individual users get their own logins, and access can be revoked the day someone hands in their notice.

Mistake #3: You Rely on a Password Alone

A password on its own won’t protect an account that holds your client data, however strong it looks. Credentials leak in third-party breaches constantly, and attackers test them against cloud storage logins at scale because that’s where the valuable files live.

The National Cyber Security Centre is clear on this point in its multi-factor authentication guidance: passwords alone are not enough to secure access to corporate online services. Turning on 2FA takes minutes per user and will block the vast majority of account takeover attempts. Make it mandatory, not optional, and start with admin accounts.

Mistake #4: You Have One Copy and No Backup

Cloud storage feels safe because the files aren’t on a laptop that can be stolen or spilled on. But sync is not backup. If ransomware encrypts files on one connected machine, the damaged versions will sync everywhere. If someone deletes a folder, that deletion syncs too.

Keep at least one separate copy of your critical data somewhere disconnected from the main account. That can be a second provider, an encrypted external drive updated monthly, or both. Check that your provider’s version history and file recovery actually work before you need them, because finding out during a crisis is too late.

Mistake #5: You Mix Client Data with Personal Files

In small teams, work and personal life blur, and so do the folders. Client contracts end up next to holiday photos, and a personal device logged into the same account becomes a doorway into confidential records.

This gets expensive under UK GDPR. When client data lives in an unstructured personal jumble, you can’t answer a subject access request properly, you can’t delete data when you’re supposed to, and one wrongly shared folder can expose far more than intended. Keep client data in its own clearly structured area, with access limited to the people who genuinely need it.

Mistake #6: You Don’t Know Who Can See What

Over the years, freelancers, former staff, old accountants and one-off collaborators all get invited into folders. Almost nobody gets removed. The result is a storage account where the honest answer to “who can open this?” is a shrug.

Build access review into offboarding, so leaving the company also means leaving the drive. Then once or twice a year, pull up the full list of users and shared folders and cut everyone who no longer needs to be there.

Fix the Cheap Problems First

None of these mistakes require a security budget to put right. Expiring links, 2FA, a company-owned account, a second copy of the data and a tidy permissions list are all free or close to it, and an afternoon of boring admin will close most of the gaps.

A useful rule going forward: if you can’t say exactly who can open a file, assume too many people can. Small firms rarely get breached through sophisticated attacks. They get breached through a forgotten link or a password someone reused in 2019, and those are the problems you can fix this week.