Have we reached the point where a group of hackers can take control of a supertanker? Perhaps cyberattacks have not quite reached that stage, but we may be getting closer, if the information published by Bloomberg on 2 October 2026 about an incident involving the VL Prosperity in US waters proves accurate. According to the news agency, FBI and US Coast Guard investigators reportedly found evidence of temporary unauthorised access to the VL Prosperity's digital propulsion system. The Liberian-flagged supertanker, managed by South Korea's Hmm Ocean Service, was approaching the Texas coast fully laden, bound for Galveston. Bloomberg's report is based on statements from US officials familiar with the investigation who were not authorised to speak publicly and therefore remained anonymous.
However, precise information about the incident is still lacking. The method of intrusion, those responsible, the duration of the access and the functions the hackers might have been able to control all remain unclear. The Coast Guard declined to comment, while the FBI referred enquiries to a statement confirming that its agents had boarded the VL Prosperity and another vessel to check the integrity of their operational and computer systems following indications that both ships' networks had been compromised. "At this time, there are no operational disruptions, vessel instability, physical dangers to crews or environmental impacts," the federal agency stated.
The official accounts from the US agencies involved do not entirely match. On 15 September, the Coast Guard announced, without naming the vessel, that its personnel and FBI agents had boarded a tanker bound for Texas on 21 August and established that its computer system might have been compromised by unidentified "foreign cyber actors". Two days later, the agencies referred to two foreign-flagged vessels boarded on 21 and 24 August in the Gulf of Mexico, as reported by Reuters, without explaining the discrepancies between the accounts. The name VL Prosperity subsequently emerged in Iranian media and was confirmed by maritime security company Dryad Global. Hmm Ocean Service confirmed the Coast Guard's intervention and stated that it follows strict cybersecurity protocols. The second vessel has yet to be identified.
As Bloomberg had previously reported, the inspection began after the tanker lost communications and the authorities received indications that its network had been compromised. A Coast Guard law enforcement team, a marine inspector, members of the Cyber Protection Team and FBI Cyber Action Team personnel boarded the vessel. They remained on board for four days, examining its computer systems and operational technology and working with the crew and management company to eliminate the threat. Rear Admiral Amy Grable, commander of the Coast Guard Cyber Command, told CBS that investigators had detected malicious cyber activity, but nothing found during the inspection indicated that the vessel had become unsafe to navigate. The collected data will undergo further analysis, and the Coast Guard will provide the owner with recommendations for addressing vulnerabilities. According to Grable, this was one of 40 to 50 missions carried out by the Cyber Protection Team over the past year.
The VL Prosperity, 333 metres long and capable of carrying approximately 2.3 million barrels of crude oil, departed from Egypt's Sidi Kerir terminal on 1 August. US officials told CBS that the vessel had slowed near the Strait of Gibraltar around the time of the attack before continuing across the Atlantic. On 20 August, Iran's Mehr news agency reported that the attack had taken place on 7 August, while the tanker was passing through the Strait, and that communications had been interrupted for 30 hours. Citing an unidentified crew member, Mehr claimed that the attackers had penetrated the engine room systems, reduced the cooling flow, increased engine speed and interfered with the fuel and lubricating oil systems. Four days later, the Iranian newspaper Tasnim published an article entitled "No American Ship Is Safe Anymore". Rob Lee, chief executive of Dragos, a company specialising in operational technology security, considered those details technically plausible, while stressing that the authorities had not yet identified those responsible. Quinton DuBose, a former Coast Guard cybersecurity official, regards the Iranian account as unverified and notes that groups linked to Tehran tend to exaggerate their capabilities. He added that attribution can take weeks or months. The United States is still investigating whether the two attacks were connected and whether Iran or another foreign adversary was responsible.
But what concerns the Coast Guard most? According to Grable, it is the connections between onboard computer networks and the systems controlling propulsion, navigation and other critical functions. On many ships, a single firewall may separate the satellite connection from critical equipment, beyond which navigation, propulsion, ballast and steering systems may share the same network. Grable believes an attacker does not need to be particularly sophisticated to move from the network into the machinery, because malicious code is already available and artificial intelligence is accelerating the process. She recommends that operators segment their networks, protect themselves against phishing emails and follow basic cybersecurity precautions. Jacob Krell of Suzu Labs, however, draws a distinction between access and control. To establish that an attack had reached the propulsion controls, he explains, it would be necessary to demonstrate that an intruder had accessed a controller capable of receiving commands and had issued a valid command. If verified, the VL Prosperity incident would be the first publicly documented and independently confirmed case of its kind involving a commercial vessel.
Asked whether unauthorised computer access could amount to a remote hijacking, Grable replied that this was a fair way to describe the general risk. Among the scenarios she fears are collisions, explosions, pollution and the blocking of port access channels. Not all analysts agree, however. DuBose considers it unlikely that anyone could take command of an entire supertanker and regards disruption to one or more subsystems as a more realistic scenario, potentially making the vessel less safe to operate. Svante Einarsson, head of cybersecurity at Dnv, described the worst-case scenario as the loss of functions on a large vessel carrying hazardous cargo, adding that most ships can nevertheless fall back on alternative systems.
To strengthen cybersecurity, the US Coast Guard published the "Cybersecurity in the Marine Transportation System" rule on 17 January 2025, which came into force on 16 July 2025. It applies to US-flagged vessels, facilities on the outer continental shelf and facilities subject to the Maritime Transportation Security Act of 2002. Since the rule entered into force, significant cyber incidents have had to be reported to the National Response Center. By 16 July 2027, shipowners and operators must appoint a cybersecurity officer, complete a risk assessment and submit a security plan for approval. A Liberian-flagged vessel such as the VL Prosperity does not fall directly under this regime. However, the Coast Guard has announced stricter scrutiny of cybersecurity practices aboard foreign vessels during Port State Control inspections, particularly where they affect compliance with the ISM Code. Consequences may range from corrective action requirements to vessel detention, denial of entry or restrictions on movement.
Mara Gambetta
