This may vary by location (especially countries), and for real legal advice you need to contact a qualified attorney, but as general guidance from a non-attorney: Anything posted to a website stands a good chance of being used, whether legal or not. When posting (or allowing someone to post), you can improve your chances of good behavior (even though you have no legal duty to do so) by ensuring that posting also includes a clear statement of your copyright and indication of terms of reuse (e.g. "Posted by permission, reuse prohibited without written permission"). To thieves this means nothing, but honest people may think twice. Visible ownership indications such as a watermark are also reminders (and also not foolproof).

As to how to react to misuse, you can contact the company who is using them, inform them they are using copyright media, and (depending on your preference) demand they stop, insist they pay you, or both. You need to be aware this may come back to your friend who may have misunderstood and gave them permissions, or even if he was not complicit they may blame him in some fashion. In the US for some types of use you can use a "Takedown notice" as provided in the Digital Millennium Copyright Act (just do a search for appropriate forms). Alternatively you could make them aware in some gentle fashion while soliciting further business, more of a "I wish you had asked first, but...and I would love to do more".

It is also worth noting that your Copyright (in the US) does not require registration, but your ability to seek redress and especially damages is much stronger if you did register your Copyright first with the Copyright office. I am not qualified to explain the details, but if you begin to do this in a serious way consider registration before allowing use.

Another aspect of this is that such use is considered commercial (this does not refer to whether you were paid, but that they are using it to promote goods or services, as in advertising). In most venues this may require model releases from those individually identifiable in the photos. This would be more of an issue for the person using them than you, though if you do end up selling a license for them, you may want to ensure you do so fully disclosing "without any model release from any participant" so it cannot come back to you.