Germany's armed forces have taken drones made by Quantum Systems out of service after hackers broke into the Bavarian manufacturer's network and planted malware on the server it uses to send out software updates.
The malicious file was disguised as an update for QBase, the company's ground control and mission planning software. The Bundeswehr grounded the aircraft as a precaution, according to the Financial Times, which reported that the decision also kept Quantum Systems out of a recent military exercise.
Quantum Systems, which the FT says was valued at €7bn in a funding round this year, said it detected the breach at the end of October and that its own investigation found "an active cyberattack by hostile actors". It confirmed the attack on 12 November, the day the story broke.
Quantum Systems says its IT and security teams contained the threat with help from the authorities and that its drones are safe to operate. "Our fleet is operational," a spokesperson said.
Reports in Germany paint a less positive picture. Der Spiegel said the malicious file reached servers at the Bundeswehr and other customers but was picked up in a check before it got near the aircraft. Handelsblatt, citing the company, reported a flight ban on the drones inside Germany, while customers abroad carried on flying them. The defence ministry in Berlin said it does not comment on the readiness of military equipment.
The company has not said what the malware was meant to do or who it believes is responsible. According to Der Spiegel, the case is being investigated by military counterintelligence (MAD), the domestic intelligence agency (BfV) and the federal cyber security office (BSI).
The Bundeswehr flies Quantum's Vector reconnaissance drone, which it calls the Falke. The company also supplies the Spanish and Dutch armed forces and, according to the FT, employs more than 200 people in Ukraine, where it has three joint ventures making strike drones, interceptors and uncrewed ground vehicles. It is not known whether the Ukrainian operations were affected.
Read next: Drone disruption: are aviation insurers ready for the risks?
Public disclosure of a successful hack is rare in the defence industry, where companies tend to deal with breaches quietly. Quantum Systems said it had been targeted because its work is critical to its customers' security.
German intelligence has been warning about this for months. In July the BfV issued a security notice telling staff at defence companies to watch for Russian spying, sabotage and cyber attacks, with firms that support Ukraine most at risk. It referred to a list published by Russia's defence ministry naming 21 European companies it claimed were making drones for Ukraine.
The attackers' route in will be familiar from the SolarWinds breach of 2020, when hackers hid malicious code in routine updates to the company's Orion software and reached thousands of its customers. Get into one supplier's update system and you have a way into every organisation that installs its software. The UK's National Cyber Security Centre covers this risk in its supply chain security guidance, which sets out 12 principles for managing suppliers.
Read next: Your clients aren't the target – their supplier is
For cyber underwriters and the brokers who place defence and technology risks, the case raises questions about attribution, supplier exposure and aggregation.
Since 31 March 2023, Lloyd's has required standalone cyber policies written by its syndicates to exclude losses from state-backed cyber attacks, in addition to any war exclusion, under Market Bulletin Y5381. Those wordings must set out how an attack will be attributed to a state. No one has been named here, but a defence supplier to a country at war, attacked while intelligence agencies were publicly warning about Russia, is the sort of claim where an insurer could look at the exclusion. Without official attribution, the insurer would normally have to prove it applies, and coverage lawyers have expected disputes over cases like this since the clauses came in. IB has looked at where the line between war and cyber attack falls and why brokers should check how their clients' wordings define a "cyber operation".
Read next: War exclusions protect insurers as cyber spillover risk emerges
Quantum Systems was the company hacked, but its customers took the operational hit, with aircraft grounded and an exercise missed. In commercial terms that is contingent business interruption, where a loss is caused by an outage at a supplier. Clients often assume a supplier's insurance will cover them, but IB has reported that cyber cover for supplier failures can be thinner than clients think, with liability under supply contracts often capped well below the cost of a real claim.
Aggregation is the other concern. A compromised update server can reach every customer at the same time, turning one event into claims across a whole portfolio. In this case the file appears to have been caught before it did lasting damage.
Brokers with clients in defence, aerospace and critical infrastructure supply chains, or among the growing number of UK businesses flying drones commercially, may want to ask three things: how their software suppliers sign and check updates, whether their cyber policy covers dependent business interruption, and how their war and state-backed attack exclusions would respond if no government ever names the attacker. Some insurers already offer cover in this area, including Markel's cyber war product for indirect losses.
