Cameras on Royal Navy K3 Scout surveillance drones were discovered transmitting data to a Chinese IP address, raising significant security concerns despite official denials of a data breach.
The incident involves K3 Scout uncrewed surface vessels, a $16 million (£12 million) fleet supplied by British defense contractor Kraken Technology Group and used by the Royal Marines and Special Boat Service (SBS) since March 2026.
The K3 Scout model, designed to carry a 600 kilogram(kg) payload and operate continuously for 30 days, has also been purchased by the US Special Operations Command and has participated in Nato trials in the Baltic.
The vulnerability originated in third-party cameras containing Chinese-made components, which were sent to the drones with assurances of security and compliance with the US National Defense Authorization Act (NDAA).
During a routine cyber vulnerability assessment, analysts detected that these cameras were sending automated "heartbeat communications"—small data packets confirming the devices were online and functioning normally—to an unauthorized IP address in China. The Ministry of Defense (MoD) subsequently cut internet connectivity to the cameras to contain the breach.
An MoD spokesman said: “A routine cyber vulnerability assessment identified an issue affecting a Kraken Unmanned Surface Vessel sub-system used by the Royal Navy. A thorough investigation found no evidence of MoD data or systems being accessed, compromised or transmitted externally.
“Our assurance and testing processes are designed to identify and address potential vulnerabilities early, and we continue to undertake routine security activity across our systems and equipment.”
While the MoD and Kraken insist there is no evidence that sensitive military data, reconnaissance imagery, or classified systems were accessed or exfiltrated, the incident has exposed critical flaws in defense supply chain auditing.
A Kraken Technology Group spokesman said: “We are aware that some third-party, NDAA-compliant cameras had a small number of components originating from outside the UK.
“After a full audit by both Kraken and the Royal Navy we are confident no sensitive information has ever been shared outside of intended channels and any potential vulnerabilities have been identified and closed.”
The drones had operated near the SBS headquarters in Poole, Dorset, and were involved in preparations for potential missions in the Strait of Hormuz, leading to fears that metadata regarding operational schedules and locations may have been compromised.
A joint audit by Kraken and the Royal Navy confirmed no sensitive information left authorized channels, but the discovery has triggered calls for stricter component origin checks in military procurement.
Alicia Kearns, the shadow security minister, said: “If we cannot say with confidence what is inside our own military equipment, we cannot say it is ours, or that we are sovereign.
“When cameras built on Chinese parts are found recording our special forces – their faces, training and operations – we should not be surprised, we should be furious that we still haven’t woken up to the realities of the threat we face.”
UK has begun a diplomatic reset with China through a series of high-profile visits to the country, with the hope of lucrative trade agreements. Earlier this year, Downing Street approved plans for a Chinese super-embassy at Royal Mint Court in the heart of London, despite concerns about the site’s proximity to sensitive communication lines.
