Remote Hacking of WHILL Wheelchairs: Unsecured Bluetooth Puts Patient Safety at Risk

In January 2026, cybersecurity researchers revealed significant security flaws in WHILL's electric wheelchairs, which allowed attackers within Bluetooth range to remotely pair with the device due to the absence of authentication controls. This flaw enabled malicious actors to take control of the wheelchair, manipulating its movement, speed settings, and configuration profiles without requiring any credentials or user interaction. CISA subsequently issued an advisory highlighting the risk, underscoring that such vulnerabilities could result in dangerous, unauthorized maneuvers or override critical safety restrictions, potentially jeopardizing user safety and privacy.

This incident exemplifies the escalating risk represented by insecure IoT medical devices, especially those operating in public or semi-public settings. With threat actors increasingly targeting Bluetooth-enabled endpoints and the medical IoT landscape expanding rapidly, similar vulnerabilities are likely to be discovered in other transportation and assistive devices, putting regulatory and patient pressures on device manufacturers and healthcare providers.

Unprotected Bluetooth connectivity in medical IoT devices poses an urgent patient safety risk, especially as the use of internet-connected assistive devices expands. Recent demonstrations and advisories show that attackers exploit even localized wireless channels if security best practices—like authentication and traffic encryption—are absent.