I creates several user groups to control the access of virtual report suite. Then I noticed one issue. The virtual report suite worked. User only can see the suite he can access. But when user open a report, and download the data there. He can get data for all virtual report suites. Then I guess this will be a big problem for us.
Users should only be able to access the virtual report suites they have permissions for. If a user is able to access a VRS that they shouldn't, and you've double checked that the permission groups don't grant them access to those report suites, that's definitely a topic that would be best solved with an incident to Customer Care.