FBI and Coast Guard Probe Cyberattacks on Oil Tankers Bound for U.S.

The FBI and Coast Guard are investigating suspected cyberattacks on at least two foreign-flagged oil tankers headed for the United States, turning a maritime security concern into a test of how the government responds when a ship’s digital systems may be compromised offshore.

A specialized Coast Guard-FBI team boarded one inbound tanker in the Gulf of Mexico on August 21, according to a joint statement cited by ABC News. The team included Coast Guard law-enforcement personnel, cyber specialists and FBI cyber investigators. A second tanker was boarded on August 24 for a similar assessment, ABC reported.

The agencies said the first vessel’s network showed indications of compromise by foreign cyber actors. They also said the crew and shore-based personnel cooperated and that investigators found no reported operational disruption, vessel instability, physical danger to crew members or environmental impact.

That distinction matters. Boarding a ship to examine its computers does not mean the vessel lost control or was nearly hijacked. It means investigators considered the possible intrusion serious enough to inspect the ship before it reached a U.S. port and to determine whether malicious code or unauthorized access remained active.

CBS News identified one of the ships as the VL Prosperity, a Liberian-flagged crude-oil tanker traveling toward Galveston, Texas. The vessel is a very large crude carrier, more than 1,000 feet long and capable of carrying about 2.3 million barrels of oil. Its size helps explain the government’s caution: even a temporary loss of communications or interference with shipboard systems could create safety and logistical risks well before any cargo reached shore.

The technical details remain unsettled. Iranian media reported that the VL Prosperity was attacked while transiting near the Strait of Gibraltar and claimed that hackers interfered with propulsion, navigation and fuel-related systems. Those allegations have not been fully confirmed by U.S. authorities. Coast Guard Cyber Command chief Rear Adm. Amy Grable told CBS that investigators found malicious cyber activity, but the United States has not publicly blamed Iran or another specific actor.

The investigation is now focused on several questions: whether the two tanker incidents are connected, which systems were accessed, whether the attackers reached operational technology that controls physical equipment, and whether the activity was espionage, disruption, coercion or a test of maritime defenses.

For the public, the immediate takeaway is limited but significant. There has been no reported spill, collision, loss of propulsion or interruption to the tankers’ operations. But the response shows that a cyber incident can trigger a law-enforcement and technical boarding even when a ship continues sailing normally.

That is the harder problem for authorities: a vessel may appear operational while investigators still need to determine whether its digital systems can be trusted. Until officials disclose more about the malware, the affected equipment and the identity of the attacker, the incidents demonstrate exposure rather than a proven campaign against the U.S. oil supply.

The next meaningful evidence will likely come from additional government statements or technical findings from the vessel operators. Those details will determine whether the August attacks were isolated intrusions or part of a broader effort to probe commercial shipping linked to the United States.