On August 21, federal authorities from the Coast Guard and FBI boarded a foreign-flagged oil tanker that was traveling toward Texas. The vessel, identified as the VL Prosperity, is capable of carrying about 2.3 million barrels of oil and had loaded nearly 2 million barrels of Saudi crude in Egypt.
The ship was reportedly attacked while sailing from Egypt’s Sidi Kerir terminal toward the United States, according to CBS News. Iran’s Mehr News Agency reported on August 20 that the ship had lost communications for 30 hours after an attack on August 7.
The reported attack occurred as the ship was transiting near the Strait of Gibraltar. U.S. officials said the vessel slowed near the strait around the time of the incident before continuing across the Atlantic. The Coast Guard confirmed that investigators found signs of malicious cyber activity aboard the vessel.
However, no official details were provided about how extensive the breach might be. Modern oil tankers rely on interconnected systems that control everything from propulsion to cargo handling. Some shipboard information and operational systems can be connected to outside networks, creating potential openings for cyberattacks. Cybersecurity experts told CBS News that an attacker could disrupt systems enough to interfere with the safe operation of a vessel without necessarily gaining complete control of the ship.
Rear Adm. Amy Grable, commander of U.S. Coast Guard Cyber Command, said investigators found evidence of a malicious cyber actor. The Coast Guard has not publicly attributed the attack to Iran or any other country or group. U.S. authorities are investigating whether Iran or another foreign adversary may have been responsible.
The investigation is ongoing, and officials are working to determine what happened during the reported 30-hour communications outage. Iranian media cited an unnamed crew member who claimed hackers interfered with engine-room systems. U.S. authorities have not publicly confirmed those specific claims.
Investigators examined the vessel’s information-technology and operational-technology systems while working with its crew and corporate operators. The team included Coast Guard law enforcement, a vessel inspector, members of the Coast Guard Cyber Protection Team, and FBI Cyber Action Team operators. The boarding operation lasted four days.
The Coast Guard said there were no reports of operational disruptions, vessel instability, physical danger to the crew or environmental damage. HMM Ocean Service, the South Korean company that manages the ship, said the Coast Guard has cleared the tanker for normal operations. The company said it is awaiting the final investigation report from U.S. authorities.
The incident may not have been isolated. Coast Guard and FBI personnel also boarded another Texas-bound energy tanker in August after a separate suspected cyberattack. U.S. authorities are investigating whether the incidents are connected.
The VL Prosperity is a 333-meter Liberian-flagged very large crude carrier. Public vessel data shows that it was headed to Galveston, Texas.
The Coast Guard said it is continuing to work with port operators, vessel owners and other maritime organizations to keep operations safe while the investigation continues.