Why Small Businesses Get Hacked: The Printers Nobody Patches

October 1st, 2026

A hooded figure typing at a laptop behind a blue overlay of binary code, a world map, and the word LOCKED.

A small business does not get hacked because it is interesting. It gets hacked because it is reachable. Automated scanners do not read your website or count your employees - they sweep the internet for open remote desktop ports, unpatched appliances, and accounts with no second factor, then sell whatever they find to whoever pays for it.

Now look at the machine in your hallway. The copier, the multifunction printer, the one with the touchscreen that everybody uses and nobody thinks about. It is a networked computer with an operating system, a storage drive, a web server, an administrator account, and a firmware version nobody has checked since the day it was installed. It is also, in most small offices, the only device on the network that appears on no asset list, no patch schedule, and in no one's job description.

That is the gap worth closing. The useful version of the question is not "why would anyone target us," it is "how much of what attackers look for do we have." Printers are a reliable answer.

The Numbers Still Say Small Business

The 2026 Verizon Data Breach Investigations Report analyzed more than 22,000 confirmed data breaches across 145 countries, drawn from incidents between November 1, 2024 and October 31, 2025. Read the size breakdown closely and the picture stops being ambiguous:

Ransomware appeared in 48 percent of confirmed breaches, up from 44 percent the year before.
Where the victim's size was known, 96 percent of ransomware victims were small and midsize businesses.
Inside small business breaches specifically, ransomware was present 88 percent of the time - against 39 percent at large organizations.
69 percent of victims refused to pay, and the median ransom payment fell to $139,875.

The cost lands mostly outside the ransom. The 2026 Breach Impact Study published alongside the report, built from roughly 70,000 U.S. cyber insurance claims, ranks business interruption as the single largest loss driver - half of paid claims exceeded $83,000, and the top 10 percent ran above $920,000. Read that as the price of the days you cannot invoice, ship, or answer the phone.

What none of those reports break out is printers. That is not reassurance; it is the finding. Equipment that is never counted as an attack surface is never defended as one, and a print fleet is where a small business keeps its most forgotten computers.

What Your Printer Actually Is

Strip away the paper trays and a modern multifunction printer is an appliance running an embedded operating system, with a network stack, a web administration console, a storage device, and a set of credentials. It authenticates users against your directory, sends mail on your behalf, and writes files to your shares. Everything you would secure on a server, it does too. Almost nothing you would do to a server gets done to it.

The specifics are consistent across offices:

The admin console was never changed. Default credentials for the device's web interface are printed in the manual, and that interface sits on your network for anyone who reaches it.
It speaks protocols with no authentication at all. Raw printing on port 9100 accepts jobs from anyone who can reach the device. Add IPP, LPD, FTP, WSD, and scan-to-folder over SMB, and the printer is a service surface rather than a peripheral.
It holds accounts. Scanning to email requires a mailbox account. Scanning to a folder requires an account with write access to a share. Panel login requires a directory account. Each one is a credential stored on the device, usually without a second factor.
It is rarely patched. Firmware updates exist and are published; the device simply sits outside whatever patch cycle the rest of the network gets, because printers get treated as furniture instead of software.
Cloud connectors nobody remembers. Someone enabled a print-from-anywhere service so a phone could print once, and the connection outlived the reason.

What It Remembers

A compromise of the printer is not a compromise of the printer. Look at what the device is holding:

The address book - every client, vendor, and employee address in the company, ready for a convincing invoice or payment-change email sent under a name the recipient recognizes.
Scan-to-email credentials - frequently a service account with a mailbox, and the ability to read what lands in it.
Scan-to-folder credentials - write access to a file share, which is often one directory hop from something that matters.
A directory bind account - the account the panel uses to authenticate users can, in many configurations, read a great deal of the directory.
Cached documents - copies of jobs sit on the device's storage, along with scanned pages that were never sent and faxes that were never collected. Clearing the job from the queue does not necessarily remove it from the drive.
Logs - a record of who printed what, when, and where the scans went, which is useful to you and equally useful to someone mapping the office.

Nothing on that list requires an exotic attack. It requires access to a device still running the settings it shipped with.

How the Break-In Actually Reaches You

For the first time in the report's history, software vulnerabilities overtook stolen passwords as the leading way in - 31 percent of breaches now start with an exploited vulnerability. Firmware counts. So does the software inside the device that handles the print pipeline; the print spooler in Windows has been patched repeatedly for flaws that let an attacker run code as the system and then move off the machine entirely. An unpatched printer is not a dead end on your network. It is a doorway with a computer behind it.

Three paths bring that doorway into a small business.

The Port Forward Someone Opened for the Copier

A port forward is a rule on your firewall that says traffic arriving from the internet at this number should go to this device inside the office. It exists so you can reach something from outside, and it does not ask who is calling. Anything a forward points at is reachable by anyone who finds the number, and scanners sweep for those numbers continuously without knowing or caring whose office they belong to.

It matters most for Remote Desktop, the built-in Windows feature for controlling a computer remotely. It is the most reliable way into a Windows network, and it is still sitting on the open internet in enormous numbers. Forescout's Vedere Labs counted roughly 1.8 million exposed RDP servers and 1.6 million exposed VNC servers in research published in 2026, with 18 percent of the RDP systems running end-of-life Windows and more than 19,000 still vulnerable to BlueKeep, a flaw patched in 2019.

In an office, this rarely arrives as a decision anyone remembers making. It arrives as a rule the copier vendor needed so they could reach the machine for service, and nobody removed it when the visit was over. It arrives as remote access switched on so one employee could work from home through a snowstorm. It arrives as the printer's web page published to the internet so staff could check supply levels from a phone. Each one solved a real problem for a week and then quietly stayed. If nobody has reviewed the rule list on your firewall lately, the guide to network firewalls covers what belongs there and what does not.

The Supply Order That Was Not a Supply Order

Phishing stays cheap because it keeps working, and print gives it an unusually good disguise. A message about a toner order, a meter reading, a firmware update, or an expiring service contract arrives looking like it came from your copier vendor, and asks for a click or a payment change. The 2026 DBIR notes that mobile devices carry higher click rates than desktops, and that attackers are shifting toward texts and scam calls, where the small screen hides the sender domain and there is no URL to hover over. The most expensive version involves no malware at all: a vendor invoice with new bank details, or a message from the owner who is in a meeting and needs this handled quietly.

The Third Party Holding the Contract

Third-party involvement in breaches rose 60 percent year over year and now appears in 48 percent of them. In a small office, the third party is usually the company that services the copier. Access opened for one repair call. A technician account that logs into the device. A managed print provider whose software reads meter counts and supply levels, which means that software is talking to your devices on a schedule. Each one is a way in that your business approved and then stopped thinking about.

Two habits close most of it: vendor access granted for a window and logged, rather than left standing, and a written list of which outside accounts can reach your systems and when each was last reviewed. Ask your copier and print providers for that list. If they cannot produce it, that is the finding.

Questions Worth Asking About Your Print Fleet

Ask these of an IT or managed print provider you are evaluating, or answer them yourself if you handle it internally. Vague answers are the finding.

Can you show me every device and account on my network, including the copiers, in writing?
Who patches the printer firmware, and on what schedule?
Is any printer's web console reachable from the internet, or still on default credentials?
Which account does the copier use to send email and write scans, and what can that account reach?
Is anything at my company reachable on port 3389 right now - including a port forward someone opened for a printer vendor?
Does anyone look at print, scan, and login logs outside business hours, or do they wait until morning?
When was the last backup restored, and who watched it happen?
Which outside vendors hold credentials to my systems, and when were those last reviewed?
What happens in the first hour after a suspected breach - and which of these answers can go in writing for my cyber insurance renewal?

The Printer Is the Easiest Place to Start

Printers get ignored because they seem boring, which is exactly what makes them useful to an attacker and, conveniently, what makes them cheap to fix. A print fleet that is inventoried, patched, released by badge, and logged accounts for a meaningful share of the exposure in an office your size - often the largest single item on the list, and the one that stays fixed.

Forward TS provides managed print services and managed IT services to Milwaukee-area businesses. The two work together here: firmware and device configuration handled on the print side, with patching, MFA, monitoring, tested backups, and vendor access control on the IT side, plus the documentation your insurer and your clients ask for. For the controls themselves, one at a time, six controls that secure your print fleet is the next read, and print and copy security in law firms walks through the same ground in a records-heavy environment. If you want to know how a starting point gets measured, security assessments covers that.

Start with a free audit to see what your network is exposing and what your devices are reporting, or contact us to talk through what your business needs.