Coast Guard, FBI boarded Texas-bound commercial oil tanker to investigate cyberattack

Coast Guard personnel and FBI agents boarded a Texas-bound commercial oil tanker last month before it could arrive at a port after determining the ship’s network may have been compromised by a foreign actor as it was crossing the Atlantic, the Coast Guard said Tuesday. 

On Aug. 21, a specialized team of Coast Guard law-enforcement personnel, a vessel inspector, Coast Guard Cyber Protection Team members and FBI Cyber Action Team operators boarded an inbound foreign-flagged commercial vessel, the Coast Guard said. The team examined both the vessel’s operational technology and information-technology systems, working with the crew and the ship’s corporate operators to oust the threat. 

“Currently, there are no reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts,” the Coast Guard said Tuesday.

The U.S. has so far not attributed the potential breach to a specific actor, but Iranian state media amplified the story in the weeks following the breach.

The Coast Guard did not identify the ship, but the vessel named in Iranian reports appears to be the VL Prosperity, a 333-meter Liberian-flagged very large crude carrier capable of carrying roughly 2.3 million barrels of oil. Public vessel data shows it was bound for Galveston, Texas, at the time. 

Unconfirmed reports of the attack first surfaced publicly after the ship passed through the Strait of Gibraltar, between Spain and Morocco.

On Aug. 20, Iran’s Mehr News Agency reported that VL Prosperity had been attacked on Aug. 7 while sailing from Egypt’s Sidi Kerir terminal toward the United States, losing communications for 30 hours. Mehr, citing an unnamed crew member, alleged that the attackers penetrated engine-room systems, reduced engine cooling flow, increased engine speed and interfered with fuel and lubricating-oil systems. 

Four days later, Iran’s Tasnim News Agency published an article: “No American Vessel Is Safe Anymore: Will Cannons Give Way to Codes?” 

The U.S. has not provided details on the extent of the possible breach, only confirming there were indications the vessel’s network was compromised. Iranian state media has claimed that hackers obtained control over propulsion, navigation and cargo systems.

The risk of penetrating a commercial oil tanker’s system goes beyond stolen data or disabled communications. Modern tankers use interconnected operational technology, or OT, to control the vessels — with propulsion, navigation and cargo systems all internet-connected. If a hostile state can reach and even hijack those systems remotely, while unlikely, an attacker could theoretically manipulate a vessel’s movement or critical machinery, potentially turning a massive oil tanker into a weapon against a port.