FBI and Coast Guard Boarded Two Hacked Oil Tankers Heading Toward the US Coast

Federal agents boarded two oil tankers in the Gulf of Mexico after cyberattacks compromised their onboard systems while they were en route to the United States, in one of the more serious confirmed hacks of commercial shipping to reach a U.S. coastline this year. The VL Prosperity, a 333-meter tanker capable of carrying more than 2 million barrels of oil, was first compromised on August 7 while sailing from Egypt toward the U.S. FBI and Coast Guard teams boarded it, along with a second, unnamed tanker, between August 21 and 24.

What the hack did to the ship

According to reporting based on federal briefings, the intrusion interfered with the VL Prosperity’s speed and fuel systems, disrupted its navigation and propulsion systems, and knocked out the vessel’s communications for more than a day. A modern oil tanker like the VL Prosperity runs much of its steering, engine control and navigation through networked operational technology systems, the same category of industrial control systems that have become an increasingly common target for state-linked hacking groups, since compromising them can affect a ship’s physical movement rather than just its data.

No injuries, but a tense response

The Coast Guard and FBI said in their joint statement that there were “no reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts” tied to the hack, despite the communications blackout and the interference with core systems. Federal cybersecurity teams boarded both vessels specifically to verify “the integrity of the vessel’s operational and information technology systems” once they reached U.S. waters in the Gulf of Mexico, treating the boarding as a precaution rather than a response to an active emergency.

A possible Iran connection

Investigators are examining whether Iran is behind the intrusion, according to CBS News reporting on the case. The timing has drawn attention because it follows a period of heightened U.S.-Israel military action against Iran, including the killing of Iran’s supreme leader earlier this year, a backdrop that has raised concern among U.S. officials about possible retaliatory cyber operations targeting American infrastructure and shipping. No formal attribution has been announced, and the investigation remains active.

Why tankers are an attractive target

Commercial shipping has increasingly been flagged by cybersecurity researchers as a soft target: vessels routinely cross between different countries’ jurisdictions, run on a mix of modern and outdated onboard software, and often lack the kind of dedicated security monitoring that’s now standard in land-based critical infrastructure like power grids or refineries. A successful intrusion into a tanker’s navigation or propulsion systems carries obvious physical risk, from a stranded vessel to a potential collision or grounding, in addition to the economic disruption of interfering with the flow of oil into U.S. ports.

How the maritime industry is responding

The Coast Guard has been expanding its cyber-focused inspection regime for vessels entering U.S. waters in recent years, and incidents like this one are likely to accelerate that push. Shipping companies and their insurers have faced growing pressure to harden onboard networks, segment operational technology from systems connected to the internet, and report intrusions faster, following a string of maritime cyber incidents globally. The owner of the VL Prosperity has not been named in public reporting, though the vessel’s onshore staff reportedly cooperated with the federal investigation once the intrusion was discovered.

How this compares to past maritime cyber incidents

Shipping has had smaller-scale brushes with this kind of attack before, including GPS spoofing incidents that have confused vessel navigation systems in contested waters and ransomware attacks that have hit port operators rather than ships themselves. What sets the VL Prosperity case apart is the direct interference with a moving vessel’s propulsion and navigation while it was actively underway and loaded with millions of barrels of crude, rather than an attack on shore-based systems or a docked ship, which is part of why the FBI and Coast Guard treated the boarding as a priority once the tanker reached U.S. waters.

What happens next

Both tankers were cleared to continue operating after the federal boardings, and there is no indication either vessel was held in port beyond the inspection period. The FBI’s investigation into the source of the attack, including the possible Iran link, is ongoing, and officials have not said whether additional vessels are believed to have been targeted in the same campaign.

What it means for US energy supply

The VL Prosperity’s cargo, more than 2 million barrels of crude, is a reminder of how much oil moves into the country aboard single vessels that, until this incident, weren’t widely thought of as a cyberattack surface by the public. Energy security analysts have long warned that pipelines and refineries face this kind of threat, but a tanker actively underway with a compromised propulsion system adds a layer of physical risk that’s harder to mitigate once a ship is already at sea, since there’s no way to simply take a vessel offline the way a company might isolate a hacked server on land. Follow Smashology Media’s Tech coverage for updates as the investigation into the tanker hacks continues.

Sources

• TechCrunch: FBI, Coast Guard boarded hacked oil tankers heading toward US coast
• CBS News: Coast Guard and FBI boarded 2 energy tankers due to cyberattacks. How big is the risk?