Cyberattacks Raise Alarms Across Global Shipping

U.S. Coast Guard personnel and FBI agents boarded two Texas-bound energy tankers after cyberattacks disrupted the vessels while they were traveling toward the United States. One was the VL Prosperity, a 1,093-foot Liberian-flagged supertanker carrying up to 2.3 million barrels of oil from Egypt to Galveston, Texas. Iranian state media reported that hackers had accessed the ship’s propulsion, navigation and cargo systems, although U.S. officials have not confirmed Iran’s involvement or publicly identified the attackers. Rear Adm. Amy Grable, commander of U.S. Coast Guard Cyber Command, said investigators found evidence of malicious cyber activity aboard the VL Prosperity. Coast Guard and FBI personnel boarded the ship for four days to search for malware and examine information technology systems. Investigators did not find evidence that the vessel was unsafe to navigate, but the Coast Guard plans to provide the owner with recommendations for addressing vulnerabilities. Authorities are still determining whether the two attacks were connected and whether a foreign adversary was responsible. The article explains that modern ships increasingly depend on internet-connected systems for navigation, propulsion, steering, ballast and other critical functions. Experts warn that a successful intrusion could cause collisions, explosions, pollution, blocked waterways or major port disruptions. Because $5.4 trillion in commerce moves through U.S. ports annually, even a short shift to manual operations could create significant delays and economic losses. Grable said attackers may not need exceptional technical skills, particularly as malicious code and artificial intelligence become more accessible. Experts recommend network segmentation, stronger defenses against phishing and basic cybersecurity practices. While some officials describe remote manipulation of a vessel as a realistic concern, former Coast Guard cyber official Quinton DuBose cautioned that completely taking over a supertanker is unlikely. He said disrupting specific subsystems enough to make a ship unsafe may be the more realistic threat. Iranian media’s claims remain unverified.

U.S. Coast Guard personnel and FBI agents boarded a Texas-bound commercial oil tanker in the Atlantic on August 21 after federal authorities found indications that the vessel’s computer network may have been compromised by a foreign actor. The Coast Guard said specialized law-enforcement personnel, a vessel inspector, Coast Guard Cyber Protection Team members and FBI Cyber Action Team operators examined the tanker’s operational technology and information-technology systems. They worked with the crew and the vessel’s corporate managers to remove the suspected threat. The Coast Guard did not identify the ship, but Iranian media reported that it was the VL Prosperity, a 333-meter Liberian-flagged very large crude carrier managed by South Korea-based HMM Ocean Service Co., Ltd. Public vessel data indicated that the tanker was traveling from Egypt’s Sidi Kerir terminal to Galveston, Texas, carrying the capacity for approximately 2.3 million barrels of oil. Iranian state media alleged that the ship was attacked on August 7, lost communications for about 30 hours, and experienced interference with engine-room, propulsion, navigation, fuel, lubrication and cargo systems. Those claims have not been independently confirmed by U.S. authorities. The Coast Guard has confirmed only that the vessel’s network showed signs of compromise and has not attributed the incident to a specific actor. The incident highlights the security risks created by the integration of internet-connected operational technology on modern tankers. A successful intrusion could potentially affect a ship’s movement or critical machinery, although the article notes that such a scenario is unlikely. The Coast Guard said there were no reports of operational disruptions, vessel instability, physical danger to the crew or environmental damage. HMM said it maintains rigorous cybersecurity protocols. Iranian media later portrayed the incident as evidence of a new cyber front in the conflict with the United States.

US government agencies are monitoring possible cyberthreats involving nearly 20 ships worldwide, according to officials familiar with the matter. The US Coast Guard has asked the vessels to provide advance notice if they intend to enter a US port, although their destinations and cargo manifests were not immediately known. The Coast Guard is coordinating with the FBI and Department of Homeland Security units. Several commercial vessels were targeted in potential cyberattacks in late August. Officials said the attackers did not appear to take control of the ships, and the Coast Guard reported no operational disruptions, vessel instability, physical danger to crews or environmental damage. The agency nevertheless boarded two inbound foreign-flagged vessels in the Gulf of Mexico on Aug 21 and Aug 24 after indications that their operational and information technology networks had been compromised. The incidents come as maritime cybersecurity concerns increase. Modern ships rely heavily on digital systems for navigation, communications and other operations, while many operational systems use aging equipment that is difficult to update. Security researchers warn that attackers could exploit these weaknesses to disrupt global supply chains. Maritime cybersecurity firm CyberOwl reported a sharp increase in ship-related incidents during the first half of the year; more than half of the attempted intrusions it detected involved malware introduced through storage devices, while others involved internet downloads or phishing. The article also cites previous incidents, including a suspected attack on an MSC vessel in France and claimed disruptions to communications systems on more than 100 Iranian oil tankers. Experts say such attacks may be intended not only to cause direct damage but also to create uncertainty and instability among governments, companies and crews.