Cyberattack forces German military to suspend use of Quantum Systems drones

German drone manufacturer Quantum Systems confirmed on 12 November that it detected a cyber incident in late October. Following it, the German armed forces (the Bundeswehr) temporarily suspended the use of a large number of the company's drones as a precaution. The case shows that Europe's drone industry, including firms positioned as alternatives to Chinese manufacturers, faces serious cybersecurity risks.

A malicious update

The company's internal investigation found an active attack by malicious actors. According to the Financial Times, the hackers managed to distribute a malicious update file through a server used to update QBase, Quantum Systems' ground control and mission planning software. The company says the threat has been contained and that customers and operators of its unmanned systems face no ongoing risk. The exact circumstances of the attack are still being investigated, and the company has not said who was behind it.

Impact on the military

The Financial Times reports that the Bundeswehr paused the use of a substantial number of Quantum Systems drones, which also kept the company out of a recent military exercise. It is unclear how many drones were affected or when they will be cleared for use again. There is no confirmation that operational systems or sensitive data were compromised. The company maintains that the attack did not affect the safe operation of its drones.

Other manufacturers

Matthias Gebauer, a correspondent for Der Spiegel, says other major drone makers have reportedly been targeted as well. No further details have been made public. Quantum Systems notes that European defence companies face persistent cyber threats, particularly those supporting Ukraine. The firm employs more than 2,000 people in eight countries and is closely involved in supplying drone technology to Ukraine.

Link to the DJI phase-out

The incident came just days after reports that the Bundeswehr plans to phase out Chinese-made commercial drones, including DJI products, over concerns about data leaks and the possibility that information on military sites and exercises could reach Chinese intelligence. The army wants to replace them with German or other European alternatives. The attack on Quantum Systems shows, however, that European manufacturers are not immune either: security depends not only on a drone's country of origin but also on its software, update infrastructure and the manufacturer's IT environment.