Printer data exposure: what your printer remembers and how to wipe it
Breach / exposure. Updated 2026-09-13. About 5 minutes to read.
Change the printer's default admin password now, and before disposal delete its address books, sign it out of cloud accounts and run a full factory reset or secure erase.
A printer looks like a dumb box, but a modern one is a small networked computer. It stores your Wi-Fi password, scan-to-email login, fax and email address books, cloud printing accounts and a log of recent jobs. Office copiers and larger multifunction printers often have a hard drive or solid-state storage that keeps images of scanned and copied pages.
The UK's NCSC notes that gigabytes of sensitive documents have been recovered from decommissioned photocopiers and printers. In 2025, researchers at Rapid7 also showed that the default admin password on hundreds of printer models could be worked out from the serial number. This guide covers both problems: securing a printer you use, and wiping one you are getting rid of.
What a printer can store
Your Wi-Fi network name and password.
Scan-to-email settings, which can include an email account's username and password.
Address books of email addresses and fax numbers.
Job logs listing document names, times and the computer that sent them.
Stored or held print jobs, scans waiting in memory and received faxes.
Links to cloud services such as the manufacturer's app, ink subscription or remote printing account.
On business machines, a hard drive or SSD with copies of scanned, copied and printed pages.
The default password problem
In June 2025 Rapid7 disclosed eight vulnerabilities affecting 748 printer, scanner and label maker models from five vendors: 689 from Brother, plus models from FUJIFILM Business Innovation, Ricoh, Toshiba Tec and Konica Minolta. The most serious let a remote attacker learn a device's serial number and generate its default admin password from it.
Brother said that flaw could not be fully fixed with a firmware update on existing machines and needed a change to how new units are made. For printers already sold, the workaround is simple: change the default admin password.
A printer admin password printed on a sticker is not a secret. Anyone who has visited your home or office, or who can reach the printer over the network, may be able to log in with it.
Secure the printer you use now
Find the printer's IP address on its network settings screen or a printed network configuration page.
Type that address into a browser on the same network to open the printer's web settings page.
Sign in with the default admin password, usually on a label, and change it to a unique password saved in your password manager.
Install the latest firmware from the settings page or the manufacturer's support site.
Turn off Wi-Fi Direct if you do not use it, or give it a strong password, so nearby devices cannot connect straight to the printer.
Never set up port forwarding to a printer. It should not be reachable from the internet.
If you use scan-to-email, create a separate email account or app password for it, never your main email password.
Wipe a home printer before selling, donating or recycling it
Cancel or move any ink subscription and remove the printer from the manufacturer's app or cloud account.
Delete address books, saved fax numbers and scan-to-email or scan-to-folder settings.
Clear any stored jobs, scans and received faxes from the job or fax memory menu.
Run a full factory reset. The wording varies by brand, for example Restore Factory Defaults, Clear All Data and Settings, or Reset All Settings. Pick the option that clears network settings as well.
Check the scanner glass, document feeder and output tray for forgotten pages.
Remove the printer from your router's list of connected devices.
If the printer is broken and you cannot reset it, assume the Wi-Fi password stored on it is exposed and change your Wi-Fi password after it leaves the house.
Office copiers and leased multifunction printers
Machines with internal storage need more than a factory reset. The NCSC's guidance treats any device that might contain storage as needing proper sanitisation, and NIST's media sanitisation guidelines, updated in 2025, set out how organisations should clear or destroy storage.
Check the manual or ask the supplier whether the model has a hard drive or SSD, and whether data encryption and automatic image overwrite are turned on.
Before the lease ends, run the machine's secure erase or disk wipe function, often found under security or administrator settings.
Put data removal in the lease contract, and ask for a written certificate of sanitisation when the machine is collected.
For highly sensitive work, such as legal, medical or financial records, ask for the drive to be removed and destroyed, or kept by you.
Printing away from home
At libraries, hotels and print shops, delete your files from the computer and empty its downloads and recycle bin before you leave.
Avoid logging in to your email on a shared computer to print. Use the service's upload option or a USB drive instead.
Collect printouts immediately. Released jobs sit in the tray for anyone to take.
Frequently asked questions
Do home printers have hard drives?
Most home inkjet and small laser printers do not have a hard drive, but they do have memory that stores settings, contacts and sometimes recent faxes or scans. Office copiers and large multifunction printers often do have one.
Is a factory reset enough for a home printer?
For a typical home printer, a full factory reset plus removing it from your cloud account is enough. For machines with a hard drive, use the secure erase function or have the drive removed.
Can someone hack my printer from the internet?
Only if it is reachable from the internet, usually because of port forwarding or UPnP on your router. Keep it on your local network only, change the admin password and install updates.
What should I do with a printer that has sensitive work documents on it?
Ask your employer's IT team before disposing of it. Many organisations require a certificate of data destruction for any device that handled their data.
Does my printer keep copies of what I scanned?
Home printers usually hold a scan only until it is sent to your computer or email, although unsent scans and faxes can stay in memory. Business machines with storage may keep images for longer unless automatic overwrite is on.