The office printer: why that device knows more than you think

Your printer or multifunction device has often been humming away in a corner for years — quietly storing scanned documents, passwords, and sometimes even a complete address book. Time to take a closer look.

The printer or multifunction device is probably the most underestimated piece of equipment in the office. It's been there for years, quietly doing its job, and nobody gives it a second thought. Until it turns out it has its own web interface with the password admin/admin, an address book containing all your clients, and a hard drive that has been faithfully storing everything ever scanned or copied on it.

This isn't a scare story. It's simply a blind spot. And you can fix it in an afternoon.

What a modern printer actually stores

A multifunction device from the last ten years is essentially a small computer with a print head attached. Here's what it can contain:

• An address book with email addresses of staff, clients, and your accountant — used for the scan-to-email feature.
• SMTP passwords, so the device can send email on your behalf.
• Your office Wi-Fi password.
• Internal storage or a hard drive holding recent scans, copies, and sometimes complete print jobs.
• Log data: who printed or scanned what, and when.

As long as the printer is sitting quietly in the corner and nobody is trying to do anything with it, there's not much to worry about. But the moment it gets replaced, sold, or someone outside your organisation stumbles across its admin page, things get interesting.

Five checks you can do yourself

1. Log in to the admin page

Almost every network printer lets you log in via a browser. Type the printer's IP address into your address bar (usually found on a sticker or via the printer's menu) and you'll land on an admin page. Not sure what the IP address is? Our IP lookup tool can help, or you can find it directly on the printer's display.

If you get in with admin and no password, or with a default password from the manual, that's your first fix: set a proper password. Store that password wherever you keep your other office passwords — not on a sticky note next to the device.

2. Take a critical look at the address book

Are there still email addresses in there for former employees? Clients you no longer work with? Your previous accountant? Clean it up. A scan accidentally sent to an old address is exactly as awkward as it sounds.

3. Set up scan-to-email properly

Many printers send scans via a dedicated mail account. Often this is a free Gmail or Outlook account that was set up "just for now" and whose password nobody can remember anymore. Do this properly using your own domain, with SPF/DKIM/DMARC correctly configured — otherwise your scans will increasingly end up in spam. See also our email security service.

4. Check the firmware

Printer manufacturers release updates, including security patches. The admin page usually has a "update firmware" button. Do this once a year, or enable automatic updates if that's an option. This is one of those things nobody does — until something goes wrong.

5. Who actually has access?

Some printers are openly accessible on the internet — literally. Check whether the admin page is only reachable from your office network and not from anywhere in the world. If you're not sure, ask your internet provider whether the printer is reachable "from the outside."

What to do when replacing or disposing of a printer

This is where things really go wrong. An old multifunction device gets picked up by the leasing company or sold second-hand, and the hard drive goes right along with it — including three years' worth of scanned contracts, pay slips, and meeting minutes.

Before you get rid of a printer:

• Look in the manual for "erase hard drive," "data overwrite," or "secure erase" and run it.
• Delete the address book manually.
• Remove stored Wi-Fi and email passwords (or perform a factory reset — but only after wiping the drive, since a reset doesn't always clear it).
• For leased devices, ask in writing whether the leasing company will wipe or remove the drive. Get that confirmed.

What about the small desktop printer?

A cheap inkjet with no screen and no network cable typically stores nothing. But as soon as it has Wi-Fi, a display, and a scan function, everything above applies. In practice: any printer that's "bigger than a shoebox" and connected to your network deserves a check.

In short

Your printer is a computer. Treat it like one: set a proper password, keep the firmware up to date, maintain a clean address book, and wipe the drive before it leaves. It takes one afternoon and saves you a very uncomfortable conversation later.

Want to know in one go who and what has access to your systems — including devices like your printer? Take a look at our access check. An hour's work, and a lot of peace of mind afterwards.