Quantum Systems, a German drone maker, said on 12 November that hostile actors attacked it in late October. It says its teams contained the threat with help from the authorities. It also says its drones are safe to operate. State authorities and outside experts are investigating. The company did not say how the attackers got in.
BleepingComputer cited Der Spiegel and the Financial Times. It reported that the attack came through a malicious update file for QBase, the company's mission-planning software. Der Spiegel reports the update was unscheduled and set off alarms inside the company. It is unclear how many customers installed it. Other reports say the German military grounded the drones as a precaution. The company's statement mentions neither the update nor the grounding.
Customers trust a vendor's update channel. One bad file can reach everyone who installs it. So buyers can treat that channel as a security control. They can ask whether updates are signed, so a customer can check a file is genuine. They can also ask for staged rollouts and a way to pause updates.