The cyber security flaw was uncovered during a routine vulnerability assessment conducted by the UK Ministry of Defence (MoD) on platforms assigned to the Special Boat Service (SBS), according to a report by The Telegraph.
Vulnerability Detected ahead of strait of Hormuz Deployment
The platforms at the center of the breach are Kraken K3 Scout-class uncrewed surface vessels, developed by British defense firm Kraken Technology Group under a program valued at approximately £12 million ($16.2 million). The 8.4-meter high-speed uncrewed craft entered service with the Royal Marines in March 2026 for reconnaissance, surveillance, target acquisition, and special operations insertion.
Inspectors determined that third-party components within the Night Navigator 3000 series Electro-Optical/Infrared (EO/IR) camera systems—manufactured by Canada-based Current Scientific Corporation—transmitted data packets known as "heartbeat signals" to confirm device activity to a China-based IP address.
The affected USVs were scheduled for deployment to the Strait of Hormuz, a critical maritime choke point for global oil shipments, as part of operations to safeguard freedom of navigation.
Defence Ministry launches inquiry
Following the discovery, the MoD and prime contractor Kraken Technology Group launched formal inquiries.
"A routine vulnerability assessment identified an issue with a subsystem integrated into Kraken USVs utilized by the Royal Navy," an MoD spokesperson said. "Following a thorough investigation, there is no evidence to suggest that MoD data or systems were accessed, compromised, or exfiltrated."
The ministry added that all external network connections for the affected cameras were disconnected as a precautionary measure.
"We are aware that certain components were sourced internationally," a spokesperson for Kraken Technology Group stated. "Following detailed audits conducted alongside the Royal Navy, we are confident that no sensitive data was transmitted to unintended channels. All potential vulnerabilities have been identified and remediated."
Supply chain risks in hybrid fleet strategy
The incident highlights growing risks within the UK's updated defense procurement strategy, which increasingly emphasizes agile tech startups alongside traditional defense contractors such as BAE Systems, Babcock, and Rolls-Royce.
Under "Project Beehive," the Royal Navy aims to build a "Hybrid Fleet" integrating conventional warships with autonomous uncrewed assets. Capable of speeds up to 55 knots and featuring a 30-day autonomous endurance, the Kraken K3 Scout platform had previously drawn interest from U.S. defense entities, including U.S. Special Operations Command (USSOCOM) and Anduril Industries.
However, the breach underscores how critical defense hardware assembled domestically or by allied nations remains vulnerable to cyber exposure through global supply chain dependencies.