Home  /  Resources  /  Case study

Case study - Government Records & Data Protection - 2 October 2026

Finding the file-sharing server nobody owned before it became the way in

We built a discovery and monitoring service for a national records agency that found every file-transfer and sharing system touching personal data, flagged the ones holding unencrypted copies, and gave each an accountable owner - so retiring or hardening them became a scheduled job, not a post-breach scramble.

Client

A national agency holding personnel and benefits records for several million people

Sector

Government Records & Data Protection

Engagement

Discovery, ownership and monitoring of file-transfer systems and the sensitive data on them - multi-quarter programme.

\1Over two decades, teams had stood up file-sharing and transfer servers for partners, contractors and one-off data exchanges. Many outlived the projects that created them. Nobody held a complete list, nobody was sure which ones kept copies of extracts, and several held personal data unencrypted because that was simply how the original exchange had been set up. Recent breaches elsewhere in government, where an unpatched sharing system was the entry point, made the question urgent: not "are we secure", but "do we even know where these are".\2
Our approach

How we worked

\1
  • Scanned network ranges and cloud accounts for file-transfer protocols and known sharing products, then reconciled the results with procurement and firewall records.
  • Sampled the storage behind each system to classify what personal data it held and whether it was encrypted.
  • Assigned a named owner to every system, with a monthly attestation that it was still needed.
  • Triaged into retire, migrate to the managed transfer service, or harden - and put the first group on a dated plan.
  • Fed patch status and access logs into one view, with alerts for unusual volumes leaving any transfer host.
  • Made it impossible to open a new transfer endpoint without registering it.
    • \2 Outcomes

    Measured results

    \1All figures verified with the client. System names and data volumes withheld in line with our standard confidentiality terms.\2
  • The agency now has one register of file-transfer systems, where previously there were several partial spreadsheets.
  • A substantial share of the systems found were retired outright, because no live process depended on them.
  • Unencrypted personal data on remaining hosts was either encrypted or removed within the first two quarters.
  • Unowned systems fell to none; every endpoint now has someone whose name is on it.
  • Time to confirm exposure when a new sharing-product vulnerability is announced dropped from days to under an hour.
    • \3
    "We thought we had a handful of these servers. We found far more, and a fair few were holding data nobody remembered putting there. Having a name against each one changed the conversation overnight."
    - Chief Information Security Officer, National Records Agency

    Working on something similar?

    If this engagement looks like the kind of problem you are facing, we would be glad to compare notes by email.

    sales@halfteck.com
    \1

    Context and constraints

    The agency could not simply switch things off. Some of the oldest transfers supported benefit payments and partner reporting, and a wrong guess about "unused" would have hurt real people. So nothing was retired on the strength of a scan alone: each candidate went through a short period of read-only observation, and its owner had to confirm in writing.

    Why ownership came before technology

    Discovery tooling found the systems within weeks. Getting someone to admit to owning them took months. We learned to ask teams for what they depended on rather than what they owned, which is a much easier question to answer honestly.

    Treating sensitive data as the unit of risk

    A transfer server with nothing sensitive on it is an annoyance. One holding a decade of unencrypted extracts is an incident waiting for a vulnerability. Classifying the contents let the team spend scarce effort on the dozen systems that mattered, not the hundred that did not.

    Lessons learned

    The first lesson was that the inventory is never finished, so the registration gate on new endpoints mattered more than the initial sweep.

    The second was that observation before retirement cost a few weeks and avoided every awkward phone call.

    The third was that a named owner and a monthly yes-or-no did more for hygiene than any dashboard.

    If you suspect your own estate has more transfer and sharing systems than anyone has listed, we would be glad to talk. Email sales@halfteck.com.

    \2