A cyber investigation aboard two tankers in the Gulf of Mexico

On 15 September 2026 the US Coast Guard acknowledged that a federal cyber team had boarded an oil tanker bound for Texas. The next day several sources reported that two vessels were involved, then that nearly twenty merchant ships were under particular watch. The case had begun a month earlier, with an account published in Tehran.

This article is also available in French.

The story arrived… before the facts

On 20 August the Iranian news agency Tasnim put out a dispatch saying that a US-bound tanker had suffered a cyberattack while transiting the Strait of Gibraltar on 7 August [1]. The report is a detailed one: thirty hours without satellite or radio communications, then an intrusion into the engine-room control systems, engine speed raised, cooling flow reduced, monitoring of the fuel and lubricating oil tanks disabled. Mehr published the same text about fifty minutes later [2]. Both dispatches say they drew their reading from “Russian-language media citing senior Russian analysts”, a source I could not find on the indexed web and most likely a Telegram channel. The trade press followed, with nothing further to add.

For three weeks the story existed only through its own republication: nothing from an owner, from the manager, from the registry (Liberian), from the port authority (Gibraltar) or from the authorities (Spanish or Moroccan).

Then, on 15 September, a Coast Guard spokesperson answered questions from Bloomberg [3]. Coast Guard personnel and the Federal Bureau of Investigation had boarded a foreign-flagged vessel on 21 August, following indications that its network had been compromised. The master, the crew and the shore staff cooperated, and the agency added that no operational disruption or injury had been recorded. Neither the Coast Guard nor the FBI names the ship. The ship was identified the next day by her technical manager and by the American press: the VL Prosperity, a very large crude carrier of 333 metres registered in Liberia under IMO 9683697, loaded in Egypt and expected in Texas.

The joint statement of 16 September

A joint statement by the FBI and the Coast Guard, published on 16 September, widens the frame [4]. It tells us that the two agencies responded on 21 and 24 August to reported network breaches aboard two foreign-flagged commercial oil tankers. Both vessels showed indications that their networks had been compromised by cyberattacks. An interagency team boarded each of them in the Gulf of Mexico to assess the integrity of their operational and information technology systems. The statement adds that there are no reports of operational disruptions, vessel instability, physical danger to crews or environmental impacts, and it identifies nobody as responsible.

The composition of the team is published for the first time [5]. It was made up of Coast Guard law enforcement personnel and, among others, a Coast Guard Cyber Protection Team, for which this is hardly a first¹, a vessel inspector and operators of the FBI Cyber Action Team. They embarked on 21 August for what the Coast Guard calls a comprehensive cyber security boarding and investigation.

The same day, Rear Admiral Amy Grable, who commands Coast Guard Cyber Command, told CBS that the investigators did find malicious cyber activity aboard [6]. She added that an attack of this kind need not be especially sophisticated, and that the event she most fears would be a vessel blocking a waterway or an incident with an environmental impact, neither of which happened here. The same article gives the length of the operation: the team stayed aboard for four days, from 21 to 24 August, so it was still there on the day the second vessel was boarded.

Public vessel data cited in the same article has the ship leaving Egypt’s Sidi Kerir oil terminal on 1 August bound for Galveston, and American officials say she slowed as she approached the Strait of Gibraltar around the time of the cyberattack. That is the first element from the American side to support the place and the approximate date, which the Iranian account alone had carried until then. No date of compromise has been published for all that.

The following day the network broadcast the filmed interview, and the rear admiral spells out what she means by sophistication [7]. Malicious source code is easy enough to come by, available right now, and in her words the advent of artificial intelligence is accelerating the rate at which action is needed. Asked what is feared when a compromised vessel approaches an American port, she lists a collision, an explosion, anything blocking the channel for other ships, and pollution. The report also shows footage of the boarding of the VL Prosperity, credited to the Coast Guard.

The lead-in goes further than what has been established: the anchor announces that foreign hackers accessed the controls of a commercial oil tanker, where the two agencies have described a compromised network and named no shipboard function.

The engine-room account is still unconfirmed

The technical manager of the first vessel, HMM Ocean Service, confirmed the boarding of the ship it operates. The company says it applies rigorous cyber protocols and is awaiting the conclusive report of the American authorities [8]. The Coast Guard has since cleared the vessel for normal operations.

None of this validates the compromises first described. The investigators were hunting for malware and combed through the shipboard information technology systems, Rear Admiral Grable’s worry being their connection to the systems that control propulsion and navigation. They found no evidence that the ship had become unsafe to navigate, and the Coast Guard is to give the owner recommendations for patching vulnerabilities. That finding describes the state of the vessel on 21 August, a fortnight after the events alleged in the strait, and says nothing about what happened there. The malicious activity is placed in the vessel’s computer systems with no function named: propulsion, steering gear, cargo control, ECDIS and AIS are untouched by anything published as of 17 September.

Rob Lee, who heads the industrial cybersecurity firm Dragos, considers the technical detail published by the Iranian agencies realistic for a vessel of this type, which makes the account plausible without corroborating it.

Two claims are left that do not overlap: a shipboard network compromise established by the authorities, and a machinery casualty described by a single source.

No attribution for now

No responsible party is named in the joint statement. It is plainly too early, and the teams need time to investigate. American officials quoted anonymously say that the possibility of Iranian involvement, or of another actor seeking to exploit the ongoing conflict, forms part of the investigation [9]. That is a line of inquiry, and it commits nothing further. That Iranian state media published the case before any American acknowledgement says something about how the information travelled, but leaves the question of the author open.

The same report flags a Department of Homeland Security intelligence bulletin, shared with law enforcement the previous week and obtained by the network, indicating that Iran has been using Chinese artificial intelligence tools to research American energy infrastructure in preparation for a possible attack. The bulletin is not public and does not concern the two vessels. It shows where the American agencies stand on Iran as these two investigations open, and nothing more.

The second vessel

The joint statement names neither ship. In the first version of its article, published in the early hours of 16 September, The Wall Street Journal wrote that the two vessels carried oil and liquefied natural gas between them [10]. Reading vessel movements together already pointed to the Kohaku, a 91,000 cubic metre gas carrier built in 2023 and registered in the Marshall Islands under IMO 9932608, which was in the Gulf of Mexico across the period and sailed from Nederland, Texas, on 28 August. Only the cargo did not fit, since this ship carries liquefied petroleum gas. The paper corrected itself on the evening of 16 September, its new version describing an oil tanker and a liquefied petroleum tanker. On the evening of 17 September Lloyd’s List named the Kohaku [11], and two hours later The Jerusalem Post attributed the same name to The Wall Street Journal [12].

What the joint statement adds about this ship is not a small thing. Until 16 September the second case rested on a newspaper report that two tankers had been attacked, with a compromise established for only one of them. The two agencies now write that the networks of both vessels showed indications of compromise. The second file moves from reporting to an official finding, with no particular shipboard system named.

Nearly twenty ships under watch

The American government is also tracking cyber threats against nearly twenty merchant ships worldwide, Bloomberg reported on 16 September [13]. The Coast Guard tracks them with the FBI and Department of Homeland Security units, and it has asked to be given advance notice if any of those ships plans to enter a US port. An official of the Cybersecurity and Infrastructure Security Agency adds that several merchant vessels were targeted in potential cyberattacks in late August, and that the attackers did not appear to have taken control of the ships themselves.

The advance-notification request is the part that bears most directly on an operator, because it turns a threat picture into an instrument of port state control. A ship on that list arrives in the United States with a likely boarding ahead of her, and with the risk of a captain of the port order that delays her entry or attaches conditions to it. A missed berth slot and a few days alongside doing nothing usually cost more than the incident itself. The request also sits on top of the notice of arrival already required ninety-six hours before the call, which leaves little room to discover the situation late.

The flag and operator of these ships go undisclosed, and nothing suggests that an owner is told when one of its vessels is on the list: the first sign may be the Coast Guard calling. The legal basis of the request is no clearer, and a marine safety information bulletin does not carry the same weight as an informal call to the managers. It sits alongside the framework the Coast Guard has been rolling out since 2025 on the cybersecurity of vessels and facilities, whose assessment and waiver strand I covered earlier.

The vector is still unknown

The file still says nothing about the vector, the code used, the entry point or the persistence, for either vessel. An operator would need them to check whether it is exposed the same way. The conclusive report that HMM Ocean Service is waiting for may contain them. Nothing says it will be public.

A third ship has since reported an incident of the same kind. The LNG carrier Vivit Africa, which left Louisiana with liquefied natural gas, failed to deliver her cargo in the Adriatic and is still looking for solutions off Barcelona. No published source connects her to these two files, and I cover her in the article on that carrier.

Update of 2 October 2026

Bloomberg reported on 2 October that FBI and Coast Guard investigators had found evidence of access to a digital system linked to the propulsion of the VL Prosperity as she approached the Texas coast [14], a dispatch republished on 5 October by Insurance Journal under the bylines of Jake Bleiberg and Ruth Liao [15]. A shipboard function is named for the first time since the case began.

The article sets two limits of its own. The access is described as temporary and concerns a system linked to the propulsion, which does not say that the propulsion was commanded. And the investigators have established neither the way in, nor how long the access lasted, nor who was behind it, nor which functions were open to them. The FBI stands by its statement of 16 September: no reported operational disruption, no vessel instability, no physical danger to the crews, no environmental impact.

What is published therefore describes an access with no measured effect. The dispatch of 20 August described engine speed raised, cooling flow reduced and monitoring of the fuel and lubricating oil tanks disabled. Nothing published joins the two descriptions yet, and the sentence of 17 September about no function being named falls on that single point.

A figure from the same week places these two boardings in a wider set. Rear Admiral Grable told CBS that the one of 21 August was among the forty to fifty missions her cyber protection team had carried out over the past year [6]. Two of them have become public.

Sources

• [1] Tasnim News Agency, US-bound oil tanker targeted in cyberattack, 20 August 2026
• [2] Mehr News Agency, US-bound oil tanker targeted in cyberattack, 20 August 2026
• [3] Reuters, US Coast Guard boarded Texas-bound oil tanker to investigate cyberattack, Bloomberg News reports, 15 September 2026
• [4] CyberScoop, Coast Guard, FBI board US-bound foreign ships in order to probe for cyberattacks, 16 September 2026
• [5] The Record, Coast Guard, FBI boarded tanker after attack by “foreign cyber actors”, 16 September 2026
• [6] CBS News, Coast Guard and FBI boarded 2 energy tankers due to cyberattacks. How big is the risk?, 16 September 2026
• [7] CBS News, Coast Guard’s cyber command chief says “we need to take action” after tanker hack, 17 September 2026
• [8] CBS News, Coast Guard, FBI boarded Texas-bound commercial oil tanker to investigate cyberattack, 16 September 2026
• [9] ABC News, Coast Guard, FBI investigating after 2 oil tankers bound for US hit with cyberattacks, 16 September 2026
• [10] The Wall Street Journal, U.S. Probes Cyberattacks on Energy Tankers Bound for American Coast, 16 September 2026
• [11] Lloyd’s List, US probes suspected Iran-linked cyber attacks on tankers bound for Texas, 17 September 2026
• [12] The Jerusalem Post, US probing Iran ties to cyberattack on energy tanker, 17 September 2026
• [13] gCaptain, U.S. tracks cyber threats against nearly 20 ships worldwide, 16 September 2026
• [14] Bloomberg, Hackers Breached Propulsion System of U.S.-Bound Oil Tanker, 2 October 2026
• [15] Insurance Journal, Hackers Breached Propulsion System of US-Bound Oil Tanker, republication of the Bloomberg dispatch, 5 October 2026