The US Coast Guard and FBI boarded a Texas-bound oil tanker after detecting signs that its computer network may have been compromised by a foreign actor while the vessel was crossing the Atlantic.
A specialist team went aboard the foreign-flagged ship on August 21, before it reached port. Coast Guard law-enforcement personnel, a vessel inspector, cyber specialists and FBI Cyber Action Team operators examined its operational technology and information-technology systems.
The team worked with the crew and the ship’s corporate operators to remove the suspected threat. The Coast Guard said there had been no reports of operational disruption, instability affecting the vessel, danger to the crew or environmental damage.
Officials have not attributed the potential breach to a particular country or group. Iranian state media highlighted the incident in the weeks afterwards, however, and reported claims that the tanker’s systems had been attacked.
The Coast Guard has not named the vessel. Reports from Iran identified it as the VL Prosperity, a 333-metre Liberian-flagged very large crude carrier capable of transporting about 2.3 million barrels of oil. Public vessel data showed it was sailing towards Galveston, Texas.
HMM Ocean Service Co., a South Korea-based ship management company, confirmed that the vessel it manages was the VL Prosperity. The company said HMM “has rigorous cyber protocols in place to ensure the safety and security of vessels under our care”.
Claims about the oil tanker cyber attack
Unconfirmed reports emerged publicly after the tanker had passed through the Strait of Gibraltar. Iran’s Mehr News Agency later reported that the alleged attack had taken place on August 7, while the ship was travelling from Egypt’s Sidi Kerir terminal to the United States.
Mehr, citing an unnamed crew member, claimed the vessel lost communications for 30 hours. It also alleged that attackers had accessed engine-room systems, reduced engine cooling flow, increased engine speed and interfered with fuel and lubricating-oil systems.
Iranian state media subsequently claimed that hackers had gained control of propulsion, navigation and cargo systems. The United States has confirmed only that there were indications the vessel’s network had been compromised, without providing details of the extent of the suspected breach.
Modern tankers rely on interconnected operational technology to manage propulsion, navigation and cargo. A successful intrusion into those systems could, in theory, allow an attacker to interfere with a vessel’s movement or critical machinery, although the source material does not state that such control was achieved in this case.
