Your office printer is a networked computer with its own operating system, storage, web admin page and network services, so an unmanaged printer can expose stored documents and give an attacker a foothold on the same network as your laptops. The fix is mostly configuration: keep firmware updated, replace any default admin password, switch off services you do not use, protect stored jobs, and put printers on their own network segment.
Below are the risks, a checklist and the security built into business printers in the store, including the HP LaserJet Pro MFP 4103fdw, HP LaserJet Pro 4003dn, HP Color LaserJet Pro MFP 4303fdw and HP Color LaserJet Enterprise M554dn.
Office printer security checklist: risk, why it matters, fix
| Risk area | Why it matters | What to do |
|---|---|---|
| Old firmware | Printer firmware is software and gets security fixes like any other | Turn on automatic firmware updates, or check quarterly |
| Default or blank admin password | Anyone on the network can change settings, forwarding rules or scan destinations | Set a unique admin password and record it in your password manager |
| Unused network services | Every open service is something else to patch and monitor | Disable protocols and features you do not use (for example legacy protocols, Wi-Fi Direct, remote file access) |
| Stored jobs and scans | Many MFPs keep jobs, address books and scan settings on internal storage | Enable encryption and secure erase where offered; wipe before disposal |
| Uncollected printouts | Payslips and customer records left in the output tray | Use secure or pull printing so jobs release only at the device |
| Flat office network | A compromised printer sits next to finance PCs and servers | Put printers on their own VLAN and only allow print traffic from user networks |
| Forgotten devices | The printer nobody owns never gets updated | Keep printers in your asset register with an owner and an update date |
Why is a printer a network security risk?
A modern multifunction printer (MFP) prints, scans, copies, faxes and emails. To do that it runs an embedded operating system, holds an address book of email addresses and folder paths, often stores jobs on flash or a disk, and offers a web page for administration. It is a computer, yet it rarely gets the attention a laptop does, and it may stay on the network for years after the person who set it up has left.
Singapore's Cyber Security Agency (CSA) agrees: its Cybersecurity Labelling Scheme started with Wi-Fi routers and smart home hubs and has since been extended to all categories of consumer IoT devices, and CSA's own page names smart printers among them. The scheme's baseline tier, built on ETSI EN 303 645, targets common weaknesses such as default passwords and checks that security updates are available.
Firmware updates: the most skipped step
Printer firmware gets security fixes in the same way a laptop operating system does. HP states that on its LaserJet Pro and OfficeJet Pro printers with HP Wolf Pro Security, automatic firmware updates are "on by default", and that Secure Boot validates the firmware as genuine HP code at start-up, rebooting to a secure recovery state if it finds an anomaly. If the setting was switched off at installation, schedule a quarterly check. HP's Security Assessment Tools flag out-of-date firmware and weak network settings across a fleet.
The PDPC's Guide to Data Protection Practices for ICT Systems lists prompt patching as a basic practice and asks organisations to run regular physical asset inventory checks covering "computers and other electronic devices (e.g. portable hard drives, printers, fax machines)". If the printer is not in your asset register, it will not be in your patch cycle either. See the most dangerous device in your office for more on asset inventories.
Default admin passwords and open services
The printer's web admin page controls scan-to-email destinations, scan-to-folder credentials, fax forwarding and network settings. With a default or blank password, anyone on the office network can change them. HP says its LaserJet Pro models with Wolf Pro Security ship with "a unique password pre-set"; still replace it with your own and keep it in the company password manager.
Next, switch off what you do not need. The PDPC guide recommends firewall ports that are "closed by default" and turning off services that are not in use. On a printer that usually means legacy protocols, Wi-Fi Direct when everyone prints over the wired network, and remote file access features.
Stored jobs, scans and disposal
MFPs can retain jobs, scans, address books and scan credentials. The listing for the HP Color LaserJet Enterprise M554dn (S$1,723.90 as listed on 23 Oct 2026, 3 years local HP warranty) reproduces HP's specifications: AES 128 or AES 256 encryption of customer and job data on its 4 GB eMMC storage, Secure Cryptographic Erase of job data, Secure Erase of the disk, HP Sure Start BIOS integrity checking with self-healing, whitelisting so that only known good code loads, run-time intrusion detection, an embedded TPM and HP Connection Inspector.
When a printer is retired, traded in or returned at the end of a lease, its storage leaves your control. The PDPC guide says to "always perform secure deletion" before redeploying, exchanging or disposing of re-writable media, and to use physical destruction of storage where secure deletion is not possible. Add "wipe the printer" to your disposal procedure; our offboarding checklist applies the same logic to people.
Secure print and pull printing
Printouts left in a shared tray are the simplest data leak. Secure print, sometimes called pull printing, holds the job until the user authenticates at the printer. HP describes HP Secure Print as letting permitted users release jobs with a QR code, keeping print jobs private and reducing waste. On FutureSmart enterprise devices, HP notes that on-device authentication requires FutureSmart firmware 4.8 or newer, and enterprise models list PIN codes, LDAP and Kerberos authentication and optional badge readers.
The PDPC's Guide on Printing Processes for Organisations adds two habits for any office: dispose of printed personal data securely, and have a data breach plan that covers printing incidents.
Put printers on their own network segment
In many small offices the printer, CCTV recorder, meeting-room TV and finance PC share one flat network. A better design puts printers on a separate VLAN and allows only print and scan traffic from the user networks. The PDPC guide lists network zones as an enhanced practice. A smart-managed switch such as the HPE Networking Instant On 1930 24-Port (S$408.00 as listed on 23 Oct 2026) supports VLANs, ACLs and 802.1X, with no subscription fee for its app or cloud management. A firewall between zones adds inspection; see our earlier guide on FortiGate firewalls for small businesses. The same segmentation idea applies to the AV gear covered in Your Smart TV Might Know More About Your Office Than You Think and the cameras in Is Your Office CCTV Protecting You or Spying on You?
SourceIT's take: a printer is the one computer in the office that everyone uses and nobody manages. Give it an owner, a password and an update schedule, and most of the risk goes away.
Which business printers have security built in?
If you are replacing printers, choose models with security on by default. Prices are as listed on 23 Oct 2026, all four were in stock at the time of writing, and each listing states 3 years local HP warranty.
- HP LaserJet Pro MFP 4103fdw (S$1,171.56): A4 mono MFP; the listing states HP Wolf Pro Security "comes embedded and preconfigured out of the box".
- HP LaserJet Pro 4003dn (S$735.14): A4 mono printer for teams of up to 10 users, with Gigabit Ethernet and built-in security features.
- HP Color LaserJet Pro MFP 4303fdw (S$1,354.45): A4 colour MFP for teams of up to 10 users.
- HP Color LaserJet Enterprise M554dn (S$1,723.90): the enterprise feature set above, including encryption and secure erase.
Browse the HP printers collection for A3 models, and see our ransomware prevention guide and Your Company Password Policy Might Be Making Security Worse.
Buying secure office printers in Singapore
SourceIT supplies HP printers with local warranty and a GST invoice. Tell us your users, monthly volume and whether you need scanning, fax or secure release, and we will suggest models. Use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg, or see our volume discounts and special pricing page. Government buyers can purchase through GeBIZ.
Frequently asked questions
Can a printer really be hacked? A network printer runs an embedded operating system and network services, so it can have vulnerabilities like any computer. Keeping firmware updated, setting an admin password and disabling unused services removes most of the easy routes in.
How often should I update printer firmware? Turn on automatic updates if the printer supports them. HP says automatic firmware updates are on by default on its LaserJet Pro and OfficeJet Pro models with Wolf Pro Security. Otherwise, check at least every quarter.
Do printers store copies of documents? Many MFPs keep jobs, scans and address books on internal storage. Use encryption and secure erase where offered, and wipe the device before disposal.
What is pull printing? Pull printing, or secure print, holds a job until the user authenticates at the printer with a PIN, card or QR code, so sensitive pages are not left in the output tray.
Does the PDPA apply to printers? The PDPC's Guide on Printing Processes applies the PDPA's Protection and Retention Obligations to printing, and its ICT guide includes printers in asset inventories and calls for secure deletion of re-writable media before disposal.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
