Coast Guard, FBI Board Texas-Bound Tanker in Suspected Cyber Breach
U.S. Coast Guard personnel and FBI agents boarded a commercial oil tanker bound for Texas in the Atlantic last month after determining the vessel’s network may have been compromised by a foreign actor, the Coast Guard said Tuesday.
The Coast Guard did not name the ship, but the case quickly drew scrutiny because of the vessel’s size, its cargo and the potential consequences of a cyber intrusion at sea. Iranian state media claimed hackers gained control of the tanker’s propulsion, navigation and cargo systems and that the ship lost communications for 30 hours.
Ship identified in Iranian reports
Iranian reports identified the vessel as the VL Prosperity, a 333-meter supertanker capable of carrying roughly 2.3 million barrels of oil. Public vessel data shows the Liberian-flagged very large crude carrier was bound for Galveston, Texas. HMM Ocean Service Co., Ltd., a South Korea-based company that manages the VL Prosperity, confirmed the Coast Guard had boarded the vessel.
On Aug. 20, Iran’s Mehr News Agency reported that the VL Prosperity had been attacked and lost communications on Aug. 7 while sailing from Egypt’s Sidi Kerir terminal toward the United States. Citing an unnamed crew member, Mehr alleged the attackers penetrated engine-room systems, reduced engine cooling flow, increased engine speed and interfered with fuel and lubricating-oil systems.
Coast Guard team boarded Aug. 21
According to the Coast Guard, a specialized team boarded the ship on Aug. 21. It included Coast Guard law enforcement personnel, a vessel inspector, members of a Coast Guard Cyber Protection Team and FBI Cyber Action Team operators. The team examined the vessel’s operational technology and information-technology systems and worked with the crew and the ship’s corporate operators to eradicate the threat.
On Tuesday, the Coast Guard said there were currently “no reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts.”
Unconfirmed reports of the attack first surfaced publicly after the ship passed through the Strait of Gibraltar, between Spain and Morocco.
Why the case matters
The episode highlights a broader vulnerability in global shipping. The risk of penetrating a commercial oil tanker’s systems extends beyond stolen data or disabled communications. Modern tankers rely on interconnected operational technology, or OT, to control the vessel, with propulsion, navigation and cargo systems linked to networks.
While such a scenario is unlikely, if a hostile state could reach or hijack those systems remotely, it could theoretically manipulate a vessel’s movement or critical machinery — potentially turning a massive oil tanker into a weapon against a port.
The United States has not provided details on the extent of the possible breach. It has only confirmed there were indications the vessel’s network had been compromised. HMM said it “has rigorous cyber protocols in place to ensure the safety and security of vessels under our care.”
No attribution yet
Washington has also not attributed the possible cyberattack to a specific actor. After Mehr’s report, Iranian state media amplified the story in the weeks following the breach, suggesting the regime was opening a new cyber front in its confrontation with the United States. Four days after Mehr’s report, Iran’s Tasnim News Agency published an article headlined “No American Vessel Is Safe Anymore: Will Cannons Give Way to Codes?”