Quantum Systems hacked: German army benches its drones

The Bundeswehr, Germany's armed forces, has apparently suspended the use of drones from Bavarian defence technology company Quantum Systems as a precaution after a cyberattack. Golem.de reports this, citing the Financial Times, which in turn relies on people familiar with the matter. The case shows how vulnerable even highly modern drone systems are when the attack targets not the aircraft itself but the software around it.

What happened at Quantum Systems?

According to the news agency dpa-AFX, Quantum Systems said a “cybersecurity incident” was identified at the end of October 2026. The company says an immediate internal investigation uncovered an active cyberattack by hostile actors. Golem.de gives the same account: the incident was discovered toward the end of October, and IT and security teams contained the threat together with the competent authorities.

The company, based in Gilching near Munich, says it reported the incident to the authorities and that it is still being investigated. According to dpa-AFX, Quantum Systems also stated that, because of the measures taken and the nature of the incident, there is no risk to end users and operators when running the systems. Asked in Berlin, the Ministry of Defence did not comment on the media report.

How did the malicious code reach customers?

According to a person familiar with the incident, quoted by Golem.de, Quantum Systems told its customers that a malicious update file had been distributed via a server. That server delivers updates for QBase, the manufacturer's ground control and mission planning software. Ground control software is the program operators use to steer drones from the ground and plan their missions.

This pattern is called a supply chain attack: attackers do not plant malicious code at the end customer directly, but in a channel the customer trusts, here the manufacturer's update server. Whether, and how far, the manipulated file was actually installed at customers is not stated in the sources we read. According to Golem.de, the effect of the disruption on individual customers is so far unclear.

What does this mean for the Bundeswehr?

According to the Financial Times, as quoted by Golem.de, the step apparently also prevented Quantum Systems from taking part in a recent military exercise. Quantum Systems makes the Vector reconnaissance drone and supplies several European armed forces, including the armies of Germany, Spain and the Netherlands. The sources we read do not show whether the Spanish and Dutch armies are also suspending their drones.

As dpa-AFX writes, the Ministry of Defence did not confirm the report. The word “apparently” in the Golem report should therefore be taken seriously: the suspension rests on anonymous Financial Times sources, not on an official statement.

Who is behind the attack?

That is open. Golem.de writes that there is so far no public evidence linking the attack to Russia or to any other state or organisation. The domestic intelligence service Verfassungsschutz did, however, warn in July of an elevated risk of Russian activity against the German defence sector, including cyberattacks, espionage and sabotage. According to Golem.de, the warning applied in particular to companies that support Ukraine.

Quantum Systems is such a company: according to Golem.de it employs more than 200 people in Ukraine and runs three joint ventures with Ukrainian firms. These partnerships build small attack drones, interceptor drones and unmanned ground vehicles. According to dpa-AFX, Quantum drones are used by Ukrainian forces in their defensive war against Russia.

What kind of company is Quantum Systems?

Golem.de counts Quantum Systems among Europe's most highly valued defence start-ups; in a funding round earlier this year it was reportedly valued at seven billion euros. According to dpa-AFX, the company makes drones for both military and civilian use, so far focused on reconnaissance and surveillance; surface and underwater drones are in development.

Among its newer products, according to dpa-AFX, is the unmanned reconnaissance system “Reliant”. It can keep watch over large areas continuously for more than ten hours, takes off vertically and carries onboard AI. Another development focus is “Mosaic”, control software for unmanned systems. For drones with AI functions, the value of the system depends heavily on software that is constantly updated.

The key points at a glance

• Discovered: end of October 2026, according to Quantum Systems an active attack by hostile actors (dpa-AFX, Golem.de).
• Vector: a malicious update file distributed via the server for the QBase software (Golem.de).
• Response: the Bundeswehr has apparently stopped using the drones as a precaution (Financial Times via Golem.de); the ministry is not commenting (dpa-AFX).
• Perpetrators: unknown, no public evidence of a link to Russia (Golem.de).
• Customer impact: unclear according to Golem.de; no risk to end users according to Quantum Systems (dpa-AFX).

What does this change for a business in the UK or the US?

For companies that use or build drones, robotics or AI-driven systems, the case is a reminder to treat the update chain as an attack route in its own right. In practice: obtain manufacturer updates only through signed channels, test them in a staging environment before rollout, and decide in advance who determines, when a supplier has an incident, whether devices are taken out of service as a precaution. Suppliers to defence or critical infrastructure should also take the German Verfassungsschutz warning seriously and clarify reporting channels to the authorities beforehand.