Dangers of Healthcare Wi-Fi-Based Location Systems

(For those that require Wi-Fi credentials as part of their network requirements.)

In 2022, a security researcher at Rapid7 bought used Wi-Fi battery units for infusion pumps on eBay. Inside them were what appeared to be valid Wi-Fi network names and passwords, traceable to a specific medical organization.

Nobody had broken into a hospital. The hospital’s own equipment had carried the keys out the door. That one finding explains why Wi-Fi-dependent medical systems carry risk, and the questions below follow it from the first device to the final bill.

In short, Wi-Fi-based devices store or handle network credentials, attackers can exploit them, and healthcare breaches are the most expensive of any industry. Systems that don’t depend on hospital Wi-Fi remove a major piece of that exposure.

Why is Wi-Fi used for medical equipment and location systems?

Because it is convenient and already there. It’s common to use Wi-Fi to run medical equipment, including infusion pumps, monitors, and real-time locating systems (RTLS), in hospitals and Skilled Nursing Facilities (SNFs).

But it puts those systems at much higher risk of a security breach through various well-documented attacks. So how do those attacks work?

How do attackers get in through Wi-Fi-enabled devices?

Through a device that already holds the keys. Across documented cases, the attack vector was a locally present hardware device, such as a Wi-Fi-enabled medical tool, smart gadget, or rogue device, that stored or had access to network credentials.

Once attackers obtain those credentials or network access via the device, they can move laterally, access sensitive data, or deploy malware on the broader system.

Healthcare environments are full of IoT and medical devices, such as infusion pumps, monitors, and HVAC sensors, that often have embedded credentials and are not always well secured. That makes them attractive targets.

The scale is large. Claroty’s 2025 analysis of more than 2.25 million connected medical devices at 351 healthcare organizations found known exploited vulnerabilities in 99% of them, and 89% ran medical systems exposed to publicly available exploits.

That raises a common question: do Bluetooth-based systems avoid the problem?

Do Bluetooth (BLE) systems avoid Wi-Fi risk?

Not always. BLE (Bluetooth Low Energy) plug-in systems may not initially appear to be Wi-Fi-based, but they often rely on Wi-Fi credentials to complete their setup and operation.

Once Wi-Fi credentials are entered, often via a BLE interface, they can be intercepted or misused if the BLE implementation lacks proper security. In essence, these systems become Wi-Fi-enabled by proxy and inherit many of the same risks as traditional Wi-Fi-connected devices.

Theory is one thing. What do real cases look like?

What do real healthcare cases look like?

Infusion pump credential exposure (2022). Rapid7 found that Baxter’s Sigma Spectrum infusion pumps, with Wi-Fi battery units, stored hospital Wi-Fi credentials. An attacker with brief physical access could attach a battery module, power-cycle the pump, and walk away with the Wi-Fi data. Baxter has since addressed the issues, and Rapid7 advises restricting physical access and overwriting stored credentials before decommissioning.

Decommissioned devices leaking credentials (2023). A Rapid7 study examined 13 infusion pumps from secondary markets such as eBay. At least eight still held wireless authentication data from their previous owners, including clear-text Wi-Fi passphrases. One Alaris pump exposed clear-text Active Directory credentials.

If an outsider acquires discarded medical equipment from a healthcare facility, they could harvest stored credentials and later use them to log into the hospital’s network. And once a network is compromised, what does it cost?

How much does a healthcare data breach cost?

More than in any other industry. IBM’s 2026 study, as reported by HIPAA Journal, puts the average healthcare breach at $6.64 million, the highest of any industry, compared with a global average of $4.99 million across all industries.

The figure has fallen from its peak, but it remains the top of the chart:

Strict regulations (HIPAA, HITECH, GDPR) and extensive remediation efforts, including forensics, notifications, credit monitoring, and regulatory fines, drive these costs up. Breaches in healthcare also take longer to identify and contain. IBM’s 2025 report put it at 279 days on average, which adds to the expense.

Those are averages. What have individual incidents actually cost?

What have real breaches cost hospitals?

Real-world cases show the financial liability hospitals face:

• Scripps Health (2021): A ransomware attack in May 2021 disrupted the five-hospital California system for nearly a month. Direct losses were estimated at $112.7 million, about $91.6 million of it lost revenue and $21 million recovery costs. Insurance covered only a fraction, and class-action lawsuits followed, along with notification for 147,000 patients.
• Universal Health Services (2020): A Ryuk ransomware attack knocked out systems across roughly 400 facilities. UHS reported about $67 million in pre-tax losses, including remediation and lost revenue from weeks of disrupted care.
• Anthem (2015): A breach affecting 79 million people led to a $16 million HIPAA fine from HHS and a $115 million class-action settlement.
• NHS England WannaCry (2017): Estimated at £92 million (about $120 million) in damage and response costs.
• Change Healthcare (2024): UnitedHealth reported about 190 million people affected, with projected 2024 attack costs of about $2.87 billion. Attackers reportedly entered through a stolen credential on a portal without multi-factor authentication.

Costs vary widely with the scale of compromised data and the extent of operational disruption. Many breaches at small clinics cost far less than the average, while prolonged ransomware outages at major health systems can run into the hundreds of millions. What stays consistent is that healthcare breaches are disproportionately costly, reflecting both the high value of medical data and the heavy consequences of lost patient trust and care disruption.

With stakes like these, are regulators changing the rules?

Are security rules for healthcare getting stricter?

Proposed rules point that way. In January 2025, HHS proposed a major update to the HIPAA Security Rule. The proposal would require a technology asset inventory and network map, network segmentation, and regular vulnerability scanning and penetration testing. As of the latest sources we found, it remains a proposed rule and is not yet final.

Even before it is final, the direction is clear: know every connected device, and limit what each one can reach. That leads to the practical question of how to reduce exposure.

What is the best way to avoid Wi-Fi credential risk?

Don’t rely on Wi-Fi for your security solutions. The simplest way to remove the exposure is to use systems that never need your network credentials in the first place.

RFT’s Help Alert® staff duress system uses LoRa gateways with beacons and BLE badges, not panic buttons that depend on Wi-Fi. It runs on proprietary beacons, hubs, and gateways, so it does not need to integrate with hospital Wi-Fi.

The system is comprehensive enough to cover a multi-story building and an entire healthcare campus. It covers inside and outside, including parking lots and outdoor facilities, with pinpoint location accuracy once the panic button is pressed.

Switching to a closed system like Help Alert reduces exposure to the credential-storage risks and costly liabilities that come with equipment that stores Wi-Fi credentials. Staff can wear the Help Alert Badge for discreet, long-range alerting indoors and out.

Schedule a demo of Help Alert® today!

What is the bottom line?

The annualized risk exposure for a hospital from attacks via compromised local devices combines a rising probability of occurrence, with IoT threats on the rise, and the heavy financial impact seen in recent breach cases. As an illustrative estimate, that can translate to an expected loss in the hundreds of thousands to a few million dollars per year when averaged out.

Each actual incident can be a budget-breaking event, so understanding these risk metrics helps hospitals prepare and allocate resources accordingly. Cybersecurity is now a key component of financial liability planning in healthcare, and choosing systems that don’t depend on Wi-Fi credentials is one of the most direct ways to reduce that risk.