Coast Guard warns of rising maritime cyber threat after tanker attacks

In August, federal agents boarded two energy tankers headed for Texas after cyberattacks disabled critical systems while the vessels crossed the Atlantic. The Coast Guard and FBI found evidence of malicious cyber activity on at least one of the ships, the VL Prosperity, a 1,093-foot Liberian-flagged crude oil tanker capable of carrying roughly 2.3 million barrels. The ship had departed Egypt on August 1 bound for Galveston. Around August 7, as it transited the Strait of Gibraltar, hackers breached onboard systems and knocked out communications for 30 hours, according to Iranian state media accounts that cited unnamed crew members. The attackers allegedly gained access to propulsion, navigation and cargo systems, reducing engine cooling flow and interfering with fuel operations.

On August 21, Coast Guard cyber personnel, FBI Cyber Action Team operators, law enforcement officers and a vessel inspector climbed aboard the VL Prosperity for a four-day investigation. Rear Admiral Amy Grable, commander of U.S. Coast Guard Cyber Command, told CBS News that teams were hunting for malware and combing through information technology systems to identify malicious activity. The real concern, she explained, was that IT systems connected to propulsion, navigation and other safety-critical machinery could be weaponized or manipulated. When investigators left the vessel, they found no evidence that it had become unsafe to navigate, though they planned to provide the owner with recommendations for patching vulnerabilities. This boarding was one of roughly 40 to 50 cyber missions the Coast Guard's Cyber Protection Team has undertaken in the past year.

The U.S. government has not publicly attributed the attacks to Iran, though Iranian state media identified the VL Prosperity shortly after the incident and claimed credit for the breach. The investigation is ongoing into whether the two tanker attacks are connected and which foreign adversary, if any, was responsible. Attribution in cyberspace typically takes weeks or months, requiring investigators to match the attacker's tactics, techniques and procedures—their digital fingerprints—against known threat actors. Experts cautioned that Iranian-linked actors are often quick to oversell their cyber influence, and the narrative remains unverified.

The vulnerability exposed by these attacks reflects a broader structural problem in modern maritime infrastructure. Commercial vessels increasingly rely on internet-connected systems for navigation, propulsion, steering, ballast and other critical machinery. Many ships are protected by a single firewall separating satellite internet connections from shared networks that control everything from ship command to engine systems. Rob Lee, CEO of Dragos, an industrial cybersecurity firm, warned that artificial intelligence could make this worse by helping attackers identify weakly protected systems and accelerate breach attempts. The technical barrier to causing disruption is lower than many assume. Grable told CBS News that malicious source code is readily available and that attackers do not need to be particularly sophisticated to penetrate these systems.

The potential consequences of a successful cyberattack near an American port are severe. A compromised vessel could block a waterway, cause a collision, trigger a pollution incident or create other safety and security hazards. The economic stakes are enormous: $5.4 trillion in commerce flows through U.S. ports annually, and even a small disruption caused by a cyber breach—such as forcing a port to shift to manual operations—can create cascading delays for tankers and cargo vessels. Grable said the concern extends to the possibility of remote manipulation of a vessel's critical systems, which she characterized as a form of remote hijacking. However, Quinton DuBose, a former Coast Guard cyber official, cautioned against overstating the threat. Ships are incredibly complicated systems, he said, and the more realistic danger is an attacker disrupting one or more critical subsystems enough to make the vessel unsafe rather than seizing complete control.

The Coast Guard is urging the maritime industry to take the threat seriously. Grable emphasized that vessel operators should focus on network segmentation, guard against phishing attacks and maintain basic cyber hygiene practices. She stressed that taking fundamental precautions would prevent most of these incidents. The federal government has increasingly imposed baseline cyber requirements across the maritime sector, recognizing that critical infrastructure demands protection. As more ships adopt satellite communications and connect IT networks with onboard control systems, they create more entry points for attackers. The warning from Coast Guard leadership is direct: the industry needs to pay attention now.