Anybody used og module for Drupal knows what powerfully features this modules give users - ability to organize themselves in public groups, private groups... Private groups gives your Drupal users opportunity to share content only accessible to other group members. BUT user will be maybe tempted to think that file attachments to private group nodes are also private, and that is off course very wrong. Drupal stores files in to publicly available 'files' folder. Every node file attachment is available with next url http://drupalsite/files/somefile.txt.