Tampered QBase update briefly grounds German military Quantum Systems drones (2026)

In mid-November 2026, Quantum Systems — the Gilching-based German defence-technology firm that builds reconnaissance and interceptor drones and the software that controls them — disclosed that it had been the target of an active cyberattack by what it called "hostile actors." The intrusion, which the company said it detected at the end of October, centred on a tampered software update and led Germany's armed forces to temporarily ground the drones they operate from the company.

What happened

According to reporting by Der Spiegel and the Financial Times citing internal sources, attackers compromised the distribution server for QBase, Quantum Systems' ground-control and mission-planning software, and pushed out a malicious file disguised as a routine update. QBase is used to plan missions for the Vector reconnaissance drone, which the Bundeswehr operates under the name Falke. Der Spiegel reported that the malicious file reached Bundeswehr and other customer servers but was caught by a check before it could reach any drones; accounts differ on how many systems were affected and for how long.

Response

The Bundeswehr grounded its Quantum Systems drones as a precaution, and two sources told the Financial Times the decision kept the drones out of a recent military exercise. Quantum Systems said it worked with the relevant authorities to resolve the issue and that its unmanned systems have since resumed operations safely, noting that the Bundeswehr "was the only customer to ground their systems as a precaution." German security agencies — reportedly military counterintelligence (MAD), the domestic intelligence service (BfV) and the federal cyber agency (BSI) — are said to be involved in the investigation.

Why it matters

Quantum Systems attributed the targeting to its prominent support for Ukraine, arguing that firms whose work is "critically relevant" to their customers' security are singled out for attack. The incident is a textbook software supply-chain compromise against a defence supplier: by subverting a trusted update channel rather than the drones themselves, attackers forced a precautionary grounding of fielded military systems and highlighted how update infrastructure has become a high-value target in the drone war around Ukraine. The company has not publicly named a suspect.