Last month, a security researcher remotely unlocked hundreds of electric scooters in downtown Manila without physical access to a single device (Source: Henri Mategui, 2026). The vulnerability chained two flaws: an unpatched Bluetooth stack in the scooter firmware and a cloud API that accepted any valid JWT token — even ones issued to deleted accounts. The company recalled 12,000 units after the researcher demonstrated the attack at a conference.
This is not an isolated incident. Smart city IoT deployments are expanding faster than the security practices needed to protect them.
The Attack Surface Is Not Growing. It Is Multiplying.
Every connected device — traffic lights, parking meters, bike-share docks, air-quality sensors — adds a node that can be discovered, scanned, and compromised. IoT devices face approximately 820,000 attacks daily worldwide (Source: Swif.ai, 2026). Most of those attacks are automated, launched by botnets that sweep IP ranges for default credentials and known firmware vulnerabilities.
Smart cities amplify the risk because they cluster thousands of devices on shared networks. A single compromised sensor can become a pivot point into the municipal fiber backbone. Connected homes faced an average of 29 daily attacks in 2025-2026, up 7 percent from the prior year (Source: CompareCheapSSL, 2025-2026).
The Electric Scooter Case Study
Electric scooters from at least seven major vendors shipped with Bluetooth Low Energy stacks that accepted unencrypted pairing requests from any device within 10 meters (Source: Henri Mategui, 2026). Combined with cloud APIs that lacked token-revocation for decommissioned user sessions, the attack chain allowed anyone with a $50 USB adapter to unlock scooters, start rides, and accrue charges to deleted accounts.
The researcher who demonstrated this did not seek ransom. He published a responsible disclosure report. But the same technique can be weaponized for fleet-wide theft, data exfiltration through cellular uplinks, or as a foothold for lateral movement into city network infrastructure.
Regulatory Catch-Up: NIS2 and Certification Programs
Until recently, smart-city procurement treated security as an afterthought. Cities issued RFPs based on cost and feature checklists, with no mandatory security requirements. That is changing.
The new EU Network and Information Security (NIS2) Directive adds stringent safety-management and incident-reporting requirements for key sectors, including smart-city infrastructure (Source: Fortinet, 2026). Vendors that supply IoT devices to public-sector buyers must now demonstrate secure-by-design development, signed firmware updates, and coordinated disclosure processes.
In the United States, UL Solutions has begun issuing IoT Security Ratings to consumer devices. Xiaomi became the first electric-scooter manufacturer to achieve the rating in 2026 (Source: UL Solutions, 2026). The program evaluates devices across three tiers — baseline, security-plus, and security-max — based on vulnerability disclosure, secure update mechanisms, and user-data protection.
What Cities Should Demand in 2026
Smart-city security requires four minimum controls:
First, procurement contracts must mandate independent third-party security audits before deployment, not after. Every IoT vendor should be required to publish a security bulletin and a vulnerability-disclosure policy as part of the RFP response.
Second, network segmentation must isolate IoT device clusters from administrative networks. Traffic from scooter docks, air-quality sensors, and smart lighting should never reach the same VLAN as city-employee workstations or financial systems.
Third, device lifecycle management must include end-of-life decommissioning. When a scooter model is retired, its cloud API tokens must be revoked, its firmware update feed must be terminated, and its cellular SIM must be deactivated. Failure to do any of these three leaves orphaned devices that attackers adopt as persistent entry points.
Fourth, incident response must account for physical-world consequences. A compromised traffic-light controller does not just produce a log entry — it causes accidents. Cities need physical-world incident playbooks, not just IT SOC runbooks.
The Cost of Getting It Wrong
The financial and reputational costs of IoT security failures are rising. A single city-wide breach can expose millions of residents' location data, transit records, and payment information. The average cost of a municipal data breach reached $4.45 million in 2026, up 15 percent from 2025 (Source: IBM Security, 2026).
But the harder-to-quantify cost is trust erosion. When residents discover their city's scooter fleet was unlockable by strangers, they stop using the service. Revenue drops. Public-private partnerships collapse. The next procurement cycle becomes a public-relations war, not a technology decision.
What Comes After Deployment
Security cannot be bolted on after deployment. The electric-scooter manufacturer in the case study above spent $3.2 million on emergency firmware updates, cloud API patches, and a city-wide recall program (Source: Henri Mategui, 2026). The same investment, applied during initial design, would have cost $180,000.
Cities that treat IoT security as a checklist item will repeat the same mistakes. Cities that bake security into procurement, deployment, and decommissioning will build infrastructure that survives the next five years of attacker innovation.
The smart city vision depends on connectivity. That connectivity depends on security. That security depends on decisions made before the first device ships.
What security control will your city mandate in its next IoT RFP?
Sources
- Henri Mategui, "Remotely Unlocking Electric Scooters" (2026) — https://henriemategui.com/post/remotely-unlocking-electric-scooters
- Swif.ai, "IoT Security Statistics for 2026" — https://www.swif.ai/blog/iot-security-statistics
- CompareCheapSSL, "IoT Device Attack Trends 2025-2026" — https://comparecheapssl.com
- Fortinet, "IoT Device Vulnerabilities: How To Secure IoT Devices" (2026) — https://www.fortinet.com/resources/cyberglossary/iot-device-vulnerabilities
- UL Solutions, "Xiaomi First to Achieve UL IoT Security Rating for Electric Scooter" — http://ul.com/news/xiaomi-first-achieve-ul-iot-security-rating-electric-scooter
- IBM Security, "Cost of a Data Breach Report 2026" — https://www.ibm.com/reports/data-breach
Metadata
- Domain: cybersecurity
- Date: 2026-08-22
- Word count: 728
- Sources: 6
Top comments (0)