Royal Navy camera subsystem reportedly sent heartbeat messages to Chinese IP address

The UK Ministry of Defence said a routine cyber-vulnerability assessment found an issue in a Kraken unmanned-surface-vessel subsystem used by the Royal Navy, after reporting that cameras on the vessels made status connections to an IP address in China. In the Royal Navy drones China data incident, the ministry said its investigation found no evidence that MoD data or systems had been accessed, compromised or transmitted externally.

The reported connections were “heartbeat” messages, automatic signals sent by a connected device to show it is online and functioning. That is materially narrower than evidence that the cameras sent imagery, audio, location information or operational plans. The Times reported that the MoD said it had found no evidence the transmissions included any of those categories of information.

The Register reported that the affected component was a camera subsystem and that Kraken had sourced the cameras from a third-party supplier. The Times reported that the supplier had previously given security assurances. Neither cited report provides a full technical account of the number of components affected, the network traffic, or all corrective actions, although The Times said internet connectivity was removed from the cameras.

What did the Royal Navy drone cameras send to China?

Reporting describes the traffic as a heartbeat signal confirming that a camera was connected and operating. The MoD’s position is that its investigation found no evidence of external transmission of MoD data or of systems being accessed or compromised.

The equipment was fitted to K3 Scout unmanned high-speed boats, which can be remotely controlled, according to The Times. Britain bought 20 under the £12.3 million Project Beehive programme, the newspaper reported. The vessels were intended for surveillance, training and operations by the Coastal Forces Squadron and 47 Commando Royal Marines.

There is no disclosed evidence in the cited reporting connecting this incident to the China-based technology companies named in a separate 2025 National Cyber Security Centre alert. That alert concerned a broader malicious cyber campaign against critical networks and urged organisations to address known vulnerabilities and monitor for suspicious activity.

For defence technology suppliers and operators, the incident raises questions about supplier assurance and component review, especially where devices include third-party hardware with their own network behaviour. It also illustrates why teams may need to scrutinize third-party components and unexpected network paths in defence equipment as part of an enterprise security program.

Kraken had not responded to The Register’s request for comment at the time of its report. The available accounts establish an unexpected outbound status connection, while the MoD’s stated finding limits what can be concluded about compromise or sensitive-data exposure.

This story draws on original reporting from The Register.