What goes wrong when share ftp credentials is shared insecurely

• Plaintext credentials on the wire. An attacker on the same Wi-Fi as the FTP client reads USER and PASS commands directly. Hotel networks and coworking spaces expose port-21 sessions in their first three packets, and PCAPs surface on dump-trading sites.
• Anonymous FTP misconfiguration. Shodan indexes tens of thousands of `vsftpd` and `proftpd` servers with `anonymous_enable=YES` left on from defaults. If the upload directory permits writes, attackers stage warez, malware, and phishing kits there — your bandwidth bill and IP reputation absorb the consequences.
• Shared `ftp` admin account. Many small studios and print shops run a single `ftp` or `admin` user that every freelancer logs in with. The password sits in onboarding wikis for years, and a single ex-contractor retains access to every job folder on the server.
• FTPS data-channel firewall breakage. Explicit FTPS encrypts the control channel but the PASV data port is negotiated dynamically. Stateful firewalls inspecting plaintext FTP cannot read the encrypted PASV reply, so the data connection silently fails — and operators 'fix' it by disabling encryption.