Quantum Systems' 9 sentence statement names no route; a relayed report names an update file

Nine sentences, 166 words, and no route named

Quantum Systems' statement of 12 November 2026 runs to nine sentences and 166 words in its body (derived count: the dateline, press contact and About text are left out). It says the company "identified a cybersecurity incident at the end of October 2026" and that an internal investigation "revealed an active cyberattack by hostile actors". It says "there is no risk in operating Quantum Systems' unmanned systems for the end users and the operators". In those nine sentences the company names no route in, no piece of software, no update, no day of detection and no affected customer.

What that does not establish. The statement does not say how long the company knew before it published. The phrase "the end of October 2026" cannot point later than 31 October, so the release came at least 12 days after the incident was identified (derived: 12 November minus 31 October = 12 days; this is this site's reading of the phrase). The statement gives no day, does not say when authorities or customers were told, and says nothing about a delay either way.

What a second page adds. BleepingComputer, on 13 November 2026, relays reports by Der Spiegel and the Financial Times, which this site did not read: that "the compromise occurred via a malicious QBase update file", that "the unscheduled update delivered to customers raised alarms within Quantum Systems", and that "it is unclear how many actually installed it". Every claim of that kind in this briefing is a relay, never a finding of this site. The statement mentions no update, no QBase, no delay in telling anyone and no military. The word customers appears once in its body, in a sentence about why companies are targeted.

Quantum Systems wrote its statement itself and, in its own About text, develops and deploys systems for "defence, security and civil resilience customers", so it has an interest in how the incident reads. This is a defence supplier: this briefing does not speculate about military consequences.

What the statement says, sentence by sentence

The table follows the statement in order. The middle column is the company's wording; the right column is what the same sentence leaves open. The sentence numbers are this site's count (derived).

The nine sentences of the statement body, in order, and what each leaves open. Source: Quantum Systems press release, 12 November 2026. The numbering is this site's.

Sentence (this site's count)	What the statement says	What it leaves open
1	"identified a cybersecurity incident at the end of October 2026"	The day, and how it was identified.
2	"An immediate internal investigation revealed an active cyberattack by hostile actors"	The route, what active means, any actor beyond that phrase.
3	"The threat was contained" with "close and transparent collaboration with the authorities"	What contained means, when, and which authorities.
4	"there is no risk in operating Quantum Systems' unmanned systems for the end users and the operators", reached through "the characteristics of the incident"	The scope is operating the systems. Software, updates, data and mission files are not addressed, and the characteristics are not described.
5	"we have reported the incident to the relevant authorities", "in accordance with our regulatory obligations"	Which authorities, which obligations, and when.
6	"The incident is under investigation in collaboration with state authorities and external and internal professional cyber experts"	An end date, or a promise of a further statement.
7	"The European defence industry has been facing persistent cyberattacks for years"	General context. It says nothing about who attacked this company.
8	"Companies at the forefront of supporting Ukraine are being targeted"	It does not say Quantum Systems was targeted for that reason, or by whom.
9	The company "has mitigation plans in place"	Which plans, and whether any was used.

Zoom

What BleepingComputer relays, and who it credits

BleepingComputer prints the Der Spiegel and Financial Times links but this site did not open them. The page mixes what it credits to others with what it says in its own voice: even its sub heading, "Update server compromised", is its own. The table separates the two.

Claims on the BleepingComputer page of 13 November 2026, who it credits for each, and their status here. Source: BleepingComputer, as saved.

Claim as BleepingComputer words it	Who it credits	Status here
The compromise "occurred via a malicious QBase update file"	Der Spiegel and the Financial Times, citing internal sources	Relayed. Not read.
"so the point of the compromise was the vendor's update distribution server"	No one: the word so makes it BleepingComputer's own inference	Inference by BleepingComputer.
The unscheduled update "raised alarms within Quantum Systems"	The German outlet, which is Der Spiegel	Relayed. Not read.
"it is unclear how many actually installed it"	The same Der Spiegel report	Relayed. The count is unknown.
QBase is "ground-control and mission-planning software"; the Vector reconnaissance drone is named as one aircraft planned with it	BleepingComputer for the description, Der Spiegel for the drone	Relayed. Not read.
The armed forces "grounded Quantum Systems drones as a precaution" and excluded its systems from "a recent military exercise"	Additional reports, with no outlet named	Relayed. Source unnamed.
The response "reportedly involves" three German bodies named MAD, BfV and BSI	Reportedly, with no source named	Relayed. Source unnamed.
A July DNS hijacking at CubePilot, a firm that "also openly supports Ukraine"	BleepingComputer's earlier article, linked on the page	Not read. No link to this incident is stated.

Zoom

Read as drawn, the relayed path has no step the statement confirms. The statement does not name the software, the server or the file, and the relays do not say what the update contained or whether anything ran on a customer's machine. BleepingComputer's own line on CubePilot is that a DNS hijacking "could, among other things, be used to deliver malicious updates" but that "such a level of compromise was never confirmed".

Side by side: no risk in operating, and an update sent to customers

The statement says there is no risk in operating the systems. The relays say an unscheduled update went to customers. The table puts the two accounts on the same rows, with a column for what neither page says.

The company's statement beside the relayed reports, topic by topic. Sources: Quantum Systems, 12 November 2026; BleepingComputer, 13 November 2026 (relayed).

Topic	The statement	Relayed by BleepingComputer	Not stated by either
How it started	No route. "an active cyberattack by hostile actors"	Via a malicious QBase update file, from Der Spiegel and the Financial Times	How the file reached the update server, and who did it.
An update	Not mentioned.	An unscheduled update delivered to customers	What it contained, and whether any customer ran it.
Customers	"customers' security" appears once, in a sentence about why companies are targeted. The no risk sentence names "the end users and the operators"	It is unclear how many installed it	A count, and any notice sent to customers.
Operating risk	"there is no risk in operating Quantum Systems' unmanned systems"	Drones reportedly grounded as a precaution, by unnamed reports	Whether a grounding happened, and what the no risk claim rests on beyond the characteristics of the incident.
The military	Not mentioned. It speaks of the "European defence industry"	Armed forces, an exercise, and three German bodies reportedly involved	Any on the record statement by a military body or agency in the pages read.
Timing	"the end of October 2026", published 12 November	"late October"	The day of detection, and when anyone was told.
Authorities	Reported "to the relevant authorities"	MAD, BfV and BSI reportedly involved	Which body received a report, and under which obligation.

The two columns are not shown to contradict each other. The company's sentence is about operating its unmanned systems and does not mention an update, so a reader cannot test it against the relayed update from the statement alone. This briefing does not conclude which account is complete. It records that the statement is silent on the thing the relays centre on.

Where the two pages differ

Differences between the statement page and the BleepingComputer page, and how this briefing treats each. Sources: both saved pages.

Point	The statement page	BleepingComputer	How this briefing treats it
Name of the event	Title tag "Quantum Systems Statement on Cybersecurity Incident", on page headline "Statement on Cyber Incident", and a web address ending cyberattack-defeated. The text says "The threat was contained" and never uses the word defeated.	Headline: "German military drone operations disrupted by cyberattack"	Reported as differences. The page's own text says contained; neither defeated nor disrupted appears in it.
When	Body: "at the end of October 2026". The page description says "late October 2026"	"late October"	Same range of days. The body wording is used.
Operations	No risk in operating. It never says operations stopped or restarted.	"ensure its unmanned systems could safely resume operations"	The word resume is BleepingComputer's. The statement does not say operations stopped.
Why targeted	"Companies at the forefront of supporting Ukraine are being targeted" in general terms.	"believes it was targeted because of its recent announcement of support for Ukraine"	The statement does not say that of Quantum Systems and mentions no announcement.
Who the aircraft serve	No customer named.	"Its drones are in service with Germany's military"	Stated by BleepingComputer in its own voice with no source on the page. Not in the statement.

On attribution the two pages agree. BleepingComputer says the company stated its view "without making a specific attribution", and this briefing names no group or state.

What is not established

• The route in. The statement names none. The update file route is a relay.
• The count of installs. Relayed as unclear.
• What was touched. No page read says whether any drone, mission data, source code or customer data was affected.
• Who the actors are. The statement says hostile actors and nothing more.
• Whether a grounding happened. It is relayed from unnamed reports.
• Any link to CubePilot. BleepingComputer only mentions the July event.
• The day of detection, and any delay. The statement gives only the end of October.
• Any regulator filing beyond "reported the incident to the relevant authorities".

The statement prints no file names, versions or indicators, and BleepingComputer prints none beyond the software name QBase. This briefing therefore has no technical section.

What to do, in order

The question the statement leaves open

Quantum Systems says there is no risk in operating its unmanned systems; will it say whether any update reached its customers outside its normal schedule, how many installed it, and when each customer was told?

Key facts