Some organizations are apparently still using the venerable FTP protocol for moving files around. Credentials for more than 7,000 FTP servers are being traded between nefarious types and used to break into servers including those of The New York Times. The access has been used to plant malicious PHP files and HTML in a bid to backdoor servers and redirect people to malicious sites.

Access to a FTP server can also be occasionally leveraged by the attackers to compromise connected web services.

"The victim companies hosting exploited FTP sites are spread across the spectrum – from small companies and individual accounts with ISPs to major multi-national corporations," noted the researchers.

"Hackers planted PHP scripts armed with backdoors (shells) and viruses in multiple directories hoping that these directories map to web servers of the victim companies to gain control of the web services. They also uploaded HTML files with seamless re-directs to malicious sites."

In many organizations, employees circumvent the official IT-approved tools and use file sharing services intended for the consumer. Now, it appears that they want what they should have been using all along: a file-sharing solution designed specifically for businesses.

The distinction between personal data and corporate data is an important one – and it’s one that business-grade solutions have been extolling the virtues of for quite some time. Companies that are allowing consumer services to be used are in danger of overreacting to the security concerns and killing the Bring Your Own Device (BYOD) policy in the process.