On internal penetration tests, misconfigured SMB shares have become one of the most consistent findings we're documenting - and the misconfiguration isn't subtle. Shares accessible to any authenticated domain user, sometimes with no authentication requirement at all, mean that a single compromised credential (or just internal network access) is enough to reach sensitive data without any further privilege escalation.
The data sitting on those shares is often significant: finance records, HR documents, IT configuration files, credentials stored in scripts. The risk isn't theoretical.
If you haven't audited your internal file shares recently, it's worth doing. Map what shares exist, what data they hold, and apply access controls based on genuine business need - not convenience or legacy configuration. The principle of least privilege applies here as much as anywhere else in your environment.