8 Serious Security Threats Your Copier Poses to Your Business

Yes. A modern business copier is a networked computer with a scanner, a printer and often a storage drive attached, so it can expose the same kinds of data as any other device on your network. Most offices simply never think of it that way.

A multifunction copier is a machine that combines copying, printing, scanning and often faxing in one device. To handle all those jobs, many models process documents as digital images and may keep them on an internal hard drive or solid-state storage.

Deleting a file does not always remove it completely. Data remanence is the leftover data that can remain on storage after files are deleted or the device is reset; Wikipedia's data remanence article explains the concept. That is why a copier's storage needs to be treated with the same care as a computer's.

The FTC's digital copier data security guide sets out practical advice for businesses across the full life of a machine, from purchase to disposal.

The eight serious threats are stored document images, default passwords, outdated firmware, open network services, unprotected scanning, unattended prints, fax and address book exposure, and disposal without wiping. Each one is manageable once you know it exists.

1. Stored document images. Many business copiers keep images of scanned, copied, printed and faxed pages on an internal drive. If the drive is accessed, those documents may be recoverable.
2. Default administrator passwords. Machines often ship with a standard admin password. If it is never changed, anyone on the network who knows it could alter settings or reach stored data.
3. Outdated firmware. Firmware is the built-in software that runs the machine. Like any software, it can have security flaws that manufacturers fix through updates.
4. Open network services. Copiers often support many network protocols and features out of the box. Services you never use still widen the ways the machine can be reached.
5. Unprotected scanning. Scan to email and scan to folder can send documents to the wrong recipient or over unencrypted connections if they are not set up carefully.
6. Unattended prints. Confidential pages left in the output tray are the simplest exposure of all, and one of the most common.
7. Fax and address book exposure. Received faxes can sit in the tray, misdialed numbers can send pages to strangers, and stored address books reveal contact details.
8. Disposal without wiping. Selling, returning or recycling a machine without erasing its storage can hand your data to whoever owns it next.

None of these threats requires an unusual attacker. Most exposures come from everyday habits: a password nobody changed, a print nobody collected, or a machine wheeled out the door without a second thought. That is good news, because everyday habits are also the easiest thing to fix.

Each threat has a clear fix, and most cost nothing but a little setup time. Use this table as a quick reference when reviewing your machines.

If any of the terms on your machine's settings menu are unfamiliar, our guide to useful copy machine jargon can help.

Secure a networked copier the same way you would secure a computer: change the default password, keep firmware current, turn off what you do not use, and control who can access it. These steps take little time and close the most common gaps.

• Change the administrator password on the control panel and the web settings page, and record it securely.
• Update firmware using the manufacturer's official updates, and check periodically for new releases.
• Disable unused services such as protocols, remote access features or apps your office does not need.
• Keep the machine off the public internet. Its web settings page should only be reachable from inside your network.
• Use user codes or login. Requiring a code to copy, scan or print adds accountability and helps track use.
• Enable encryption and overwrite features for stored data if the machine offers them.
• Lock down the address book so only administrators can add or change scan and fax destinations.

Decide who owns this job. In a small office it might be the office manager or an outside IT provider; in a larger one, the IT team. What matters is that someone is named, keeps the admin password safe and checks the machines on a regular schedule, rather than assuming the copier looks after itself.

If you are choosing a new machine, ask about these security features before you buy. Many current multifunction copiers include them as standard or as options.

Protect printed documents and faxes by holding sensitive jobs until the right person is standing at the machine, supervising output trays and shredding anything confidential you no longer need. Physical security matters as much as network settings.

Secure print release is a feature that holds a print job in the machine until the sender enters a PIN or logs in at the control panel. It prevents payroll, HR or client documents from sitting in the tray for anyone to read.

For faxes, place the machine in a supervised area and consider memory receive or confidential mailbox features where available. Our guide to why many offices still need a fax machine covers fax security in more detail. Healthcare offices should also follow the HHS HIPAA guidance for protected health information.

Finally, shred confidential paper before it leaves the building, including misprints and extra copies. A cross-cut or micro-cut office shredder near the copier makes this easy, and reconditioned shredders are another option for smaller budgets.

Before a copier leaves your office for any reason, erase or remove its stored data. This applies whether you are selling it, trading it in, returning it at the end of a lease, donating it or sending it for recycling.

Many business copiers include a data overwrite or initialization function that erases stored images and settings. Others may need the drive removed and destroyed or securely wiped by a qualified technician. Check the machine's manual or the manufacturer's documentation for the correct process.

• Print or export any settings, address books or user codes you want to keep.
• Run the machine's data overwrite or initialization function, following the manual.
• If unsure, have a technician remove the drive and keep or destroy it.
• Get written confirmation of how data was handled if a third party collects the machine.

If you lease equipment, ask how the leasing company handles stored data on returned machines before you sign. Our guide to buying versus leasing office equipment covers other end-of-term questions.

Work through this checklist for every copier and multifunction machine in your office, then repeat it at least once a year.

1. Inventory your machines. List every copier, printer and fax, with its location and whether it has internal storage.
2. Change default passwords. Set a strong administrator password on each machine.
3. Update firmware. Apply the latest manufacturer updates.
4. Turn off unused features. Disable network services, apps and remote access you do not need.
5. Enable data protection. Switch on drive encryption and automatic overwrite where available.
6. Set up secure printing. Turn on PIN or login release for sensitive documents.
7. Review scan and fax destinations. Clean up address books and restrict who can edit them.
8. Place shredders nearby. Make it easy to destroy unwanted confidential pages.
9. Write a disposal policy. Require data overwrite or drive removal before any machine leaves.

If you are replacing an older machine, the CopyFaxes team can help you compare office copiers and ask the right questions about security features before you buy. Contact our team with your volume and requirements, or try the machine finder to narrow your options.