Most businesses don’t give a second thought to the documents they host publicly on their websites. PDFs, Word documents, spreadsheets, brochures, datasheets — they are just resources for clients, partners, or regulators. But to an attacker, these files are an opportunity. A goldmine, in fact.

When a cybercriminal targets an organisation, one of the first things they might do is scrape every document they can find on that company’s domain. It's not rocket science — there are automated tools that can find and download every file with extensions like .pdf, .docx, .xlsx and more. What they do next is where the real magic happens.

These documents, even when they look perfectly innocent, are often bursting with hidden data. Metadata, to be precise. This is information stored within the file that’s not always visible when you open it. Think of it like the label inside your shirt — it's not obvious, but it reveals a lot.

Attackers can extract email addresses, usernames, software version details, even internal network share paths. Suddenly, your white paper about procurement processes is also offering up your employee usernames and telling hackers which version of Microsoft Word was used to write it. That software version info? It can be used to tailor client-side exploits. If an attacker knows you’re running an older version of a specific tool, they can cherry-pick the best vulnerabilities to try.

Now, let’s say they’ve pulled a batch of usernames from your documents. These can be tested against your login portals. If your organisation uses firstname.lastname or similar patterns, an attacker might already be halfway to breaking in. They might try credential stuffing, brute-force attempts, or craft a spear phishing campaign with chilling accuracy, thanks to the names and roles exposed.

But it doesn’t stop there. Attackers are clever about the actual content too. They'll run automated searches inside every file they collect, looking for keywords like “confidential,” “private,” “do not distribute” — all red flags that the document was never meant to be public in the first place.

They might also run pattern-matching tools to find personal data, like National Insurance numbers, credit card details, or even passport numbers. These are often hiding in plain sight, buried in old presentations or spreadsheets uploaded years ago and forgotten about. For companies in regulated sectors, this creates a serious compliance risk.

All of this happens silently. Your company is unlikely to know it is being probed this way. No alerts go off. No antivirus screams. It’s just someone downloading documents from your public site — nothing that would raise suspicion. And yet, the implications are serious.

So, what should you do? Start by sanitising your documents before publishing them. Strip out metadata. Many document creation tools offer this as a standard option, but it is rarely used. Consider converting documents to flat formats, like images or clean PDFs that have no underlying metadata.

You should also be auditing what you make public. Just because it is in a “resources” or “downloads” section doesn’t mean it’s harmless. Create an internal process to review all uploads for sensitive content. Better still, automate scanning for metadata and keywords so nothing slips through.

This is not a high-level espionage tactic. It is basic reconnaissance. And it works — because we often leave the door open without even realising.