Breach Alert: Copiers Are a Risk

An important lesson about leased copy machines: many contain hard drives that should be scrubbed of information before the copiers are returned.

As part of an investigation, CBS Evening News bought four copy machines from a company that had leased them to four different organizations and hired a firm to analyze what was on their hard drives. The machines contained confidential medical information, according to the analysis by Digital Copier Security Inc., Shingle Springs, Calif.

Most copiers have hard drives. Most copiers used in business settings are leased, and most of the machines in use today have at least one hard drive. The hard drives are necessary, because most copiers also now handle printing, faxing, scanning and e-mail.

The information stored on a copier's hard drive varies widely by manufacturer. Some machines more readily capture and store images on the hard drive. Some have a hard drive that has a large part of its capacity used for operating code. Who knows what types and the amount of confidential and/or restricted information is going out the door.

As a matter of security awareness organizations may want to restrict who can use the copier and train staff members on what information should not be copied, scanned or e-mailed using the device. Organizations need to develop, implement and make their staff aware of the information security issues.

Before returning a leased copier, the user should remove all information from the hard drive. This can be accomplished by scrubbing the hard drive, removing it, destroying it, and replacing it with a new drive before the copier is returned.