Coast Guard, FBI board oil tanker after detecting potential cyberattack

On August 21, federal agents boarded a massive oil tanker crossing the Atlantic toward Texas after determining that someone had broken into its computer systems. The team that climbed aboard the VL Prosperity—a Liberian-flagged vessel capable of carrying 2.3 million barrels of crude—included Coast Guard law-enforcement personnel, a vessel inspector, members of the Coast Guard Cyber Protection Team, and FBI Cyber Action Team operators. Their mission was to identify the breach, contain it, and work with the ship's crew and corporate operators to remove the threat before the vessel reached port in Galveston.

The incident itself had occurred days earlier. On August 7, as the VL Prosperity sailed from Egypt's Sidi Kerir terminal toward the United States, the ship's network was compromised. According to reports that emerged after the vessel passed through the Strait of Gibraltar, the ship lost communications for thirty hours. The Coast Guard's official statement, released Tuesday, emphasized that despite the breach, there were no operational disruptions, vessel instability, physical danger to crews, or environmental impacts. The agency did not provide extensive details about what the attackers accessed or how deeply they penetrated the ship's systems.

What happened next revealed the geopolitical dimensions of the incident. Iranian state media seized on the story and amplified it significantly in the weeks following the breach. On August 20, Iran's Mehr News Agency published an account citing an unnamed crew member, claiming that hackers had penetrated the engine-room systems, reduced engine cooling flow, increased engine speed, and interfered with fuel and lubricating-oil systems. Four days later, Iran's Tasnim News Agency published an article with a pointed headline: "No American Vessel Is Safe Anymore: Will Cannons Give Way to Codes?" The U.S. government, by contrast, has not attributed the breach to any specific actor and has released no details about the extent of the compromise.

The vulnerability exposed by this incident cuts to the heart of modern maritime infrastructure. Contemporary oil tankers rely on interconnected operational technology—systems that control propulsion, navigation, and cargo handling—all connected to networks that can theoretically be reached from outside the vessel. If a hostile state could penetrate and take control of these systems remotely, the consequences could extend far beyond stolen data or disabled communications. An attacker with access to a tanker's propulsion and navigation systems could theoretically manipulate the vessel's movement or critical machinery. A 333-meter ship carrying millions of barrels of oil, if hijacked remotely and directed toward a port or coastal infrastructure, could become something far more dangerous than a cargo vessel.

The boarding of the VL Prosperity represents one of the first public instances of U.S. authorities responding to a suspected cyberattack on a commercial oil tanker in real time, intercepting the vessel before it reached port. It signals that federal agencies are taking the threat seriously enough to deploy specialized cyber teams to foreign-flagged vessels in international waters. Yet the gap between what the U.S. has confirmed and what Iranian media has claimed remains wide. The American government's restraint in attribution and detail stands in sharp contrast to Tehran's willingness to publicize the incident and draw conclusions about American vulnerability. What remains unclear is whether the breach was a probe, a demonstration of capability, or something more targeted—and whether this incident represents an isolated event or a preview of a new frontier in maritime conflict.