1. A method for controlling data storage access in an organization having users of a file system, said file system having storage elements, comprising the steps of: recording accesses of said users to said storage elements and deriving respective access profiles from said recorded accesses; biclustering said users and said storage elements to define corresponding user clusters and data clusters, wherein said access profiles of said users in said user clusters are mutually similar and define a respective normal access behavior for each of said user clusters, and said storage elements in said data clusters are accessed by said users having said mutually-similar access profiles; detecting a suspicious access to said storage elements of one of said data clusters by one user in one of said user clusters that is inconsistent with said normal access behavior to said one data cluster by other users in said one user cluster; and responsively to said step of detecting a suspicious access, issuing an alert that said one user has exhibited atypical access behavior.