U.S. Coast Guard and FBI teams boarded a foreign-flagged oil tanker bound for Galveston on Aug. 21 after detecting signs the vessel's network may have been compromised during its Atlantic transit. Teams inspected the ship's OT and IT systems and worked with crew and corporate operators to remove the suspected threat; officials reported no operational, safety, or environmental impacts. Iranian state media later named the ship as the VL Prosperity and described more severe intrusions, but U.S. authorities have not attributed the breach or released full technical details.
Coast Guard and FBI Board Texas-Bound Tanker After Suspected Cyberattack
Coast Guard, FBI boarded Texas-bound oil tanker to investigate cyberattack
U.S. Coast Guard personnel and FBI Cyber Action Team operators boarded a foreign-flagged commercial oil tanker bound for Galveston, Texas, on Aug. 21 after authorities detected signs that the ship's network may have been compromised while it crossed the Atlantic, the Coast Guard said.
Boarding and Assessment
A specialized boarding team that included Coast Guard law-enforcement personnel, a vessel inspector, members of the Coast Guard Cyber Protection Team and FBI cyber operators inspected the ship's operational-technology (OT) and information-technology (IT) systems. The team worked with the vessel's crew and corporate operators to identify and remove the suspected threat.
"Currently, there are no reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts," the Coast Guard said.
Allegations and Media Reports
The U.S. has not publicly attributed the possible intrusion to any specific actor or provided full details on the extent of the compromise. In the weeks after the incident, Iranian state media amplified reports naming the vessel as the VL Prosperity, a 333-meter, Liberian-flagged very large crude carrier (VLCC) with an approximate capacity of 2.3 million barrels, which vessel-tracking data showed was bound for Galveston at the time.
Iran's Mehr News Agency reported that the VL Prosperity allegedly lost communications for about 30 hours following an incident it dated to Aug. 7, and quoted an unnamed crew member who claimed attackers penetrated engine-room systems and interfered with propulsion-related systems. Iranian outlets later ran opinion pieces highlighting the potential threat of maritime cyberattacks.
Risks and Context
Modern tankers rely on interconnected OT systems that control propulsion, navigation and cargo handling. While remote takeover of those systems is considered unlikely, a successful intrusion could—at least in theory—allow manipulation of a vessel's movement or critical machinery, creating serious safety and environmental hazards.
What Is Known—and What Is Not
What is confirmed: a joint Coast Guard–FBI team boarded the vessel on Aug. 21, inspected OT and IT systems, and worked to remove a suspected threat; officials reported no operational, crew-safety, or environmental impacts. What is not confirmed: public attribution to any actor and a detailed public accounting of the scope or technical nature of the suspected intrusion. Independent verification of the specific operational claims reported by Iranian media has not been made public.
Why it matters: The incident underscores growing concerns about maritime cybersecurity and the potential consequences when operational systems on large commercial vessels are networked and remotely accessible.
Help us improve.
