Threat Intelligence · Incident Response
US Coast Guard Boarded Supertankers After Cyberattacks Exploited Known Flaws
Two US-bound supertankers were boarded by Coast Guard and FBI cyber teams after hackers exploited known, unpatched vulnerabilities. No operational disruption was reported, but the incidents highlight risks to maritime cybersecurity.
Ross GrantUpdated 3 min read
The short version
Two large ships heading for the US were hacked because they had not fixed known security problems in their computer systems. The Coast Guard and FBI boarded the ships to check for damage. No one was hurt, but the case shows why keeping systems updated is important.
By the numbers
- 2number of supertankers boarded by US authorities after cyberattacksBankInfoSecurity
- 87%maritime organisations reporting a significant OT cybersecurity incident in the past 12 monthsBankInfoSecurity
- 17%maritime organisations describing themselves as fully recovery-readyBankInfoSecurity
What happened?
Two US-bound supertankers were boarded by Coast Guard and FBI cyber teams in August after hackers exploited known, unpatched vulnerabilities in their onboard systems. No operational disruption or harm was reported, and the ships continued to their destinations. The specific vessels and vulnerabilities have not been officially named.
What triggered the Coast Guard boardings?
In August, two supertankers heading for the US were boarded in the Gulf of Mexico by teams from the Coast Guard and FBI. This followed signs that hackers had compromised the vessels' networks. According to a joint statement from the agencies, the boardings on August 21 and 24 were to check the integrity of both operational and information technology systems after these cyber incidents. The ships were allowed to continue to their destinations as there were no reports of operational disruption, vessel instability, or harm to crew or the environment. (BankInfoSecurity (opens in a new tab))
How did the attacks happen?
A US official speaking anonymously said both incidents were caused by known vulnerabilities that had not been patched. This means the attackers took advantage of security flaws that were already documented and for which fixes existed, but the vessels had not applied them. The official called the incidents "preventable." The specific vulnerabilities and how they were exploited have not been detailed publicly.
Which vessels were affected?
While the Coast Guard and FBI have not named the vessels, other reporting by security researchers points to the Liberian-flagged crude oil supertanker VL Prosperity and the Marshall Islands-flagged LPG supertanker Kohaku. There was also mention of a third vessel, Vivit Africa LNG, reportedly attacked while sailing to Italy. All three incidents may have occurred as the ships passed through the Straits of Gibraltar, a key maritime chokepoint. However, these vessel names have not been officially confirmed by authorities.
What is the risk to ships and crews?
Modern ships rely on both IT (information technology) and OT (operational technology) systems. IT covers business and communications, while OT runs things like navigation and propulsion. These systems are now closely linked, so a breach in IT can potentially give attackers access to OT, raising the risk of disrupting ship operations or even endangering the crew. In these incidents, Coast Guard Cyber Command said their teams found "malicious cyber activity" on board, but did not specify if OT systems were affected.
How common are maritime cyber incidents?
Cybersecurity in the maritime sector is still developing. A recent survey found that 87% of maritime organisations had experienced a significant OT cybersecurity incident in the past year, higher than other sectors. Only 17% of maritime respondents said they were fully ready to recover from such incidents. Many cited legacy technology and a lack of onboard security expertise as major challenges. New US rules now require ships to report cyber incidents as "hazardous conditions" before arriving at port, which can trigger boardings like these.
What happens next?
The boardings show that US authorities are taking maritime cyber risks seriously and are willing to board ships to investigate. The incidents also highlight the importance of patching known vulnerabilities. For vessel operators, this means reviewing their security practices, ensuring systems are up to date, and preparing for possible inspections. For the wider industry, the events are a warning that cyberattacks on ships are not just theoretical and that the consequences can be serious, even if no immediate harm is reported.
Practical advice for maritime operators
- Regularly patch and update all onboard IT and OT systems.
- Maintain a complete inventory of all digital assets on the vessel.
- Train crew in basic cybersecurity awareness.
- Prepare incident response plans that include cyber scenarios.
- Report any suspicious activity to authorities as required by law.
Uncertainties
- The specific vulnerabilities exploited have not been disclosed.
- The official names of the affected vessels have not been confirmed by authorities.
- There is no official attribution of who carried out the attacks.
- Only one outlet has reported these new details so far; further confirmation is needed.
Claimed vs confirmed
- Unconfirmed
The attacks were linked to Iranian actors.
There was suspicion of Iranian involvement, but no official or vendor attribution has been made.
- Unconfirmed
The vessels affected were VL Prosperity and Kohaku.
Security researchers have identified these vessels, but authorities have not confirmed the names.
The impact
- Money
- No direct financial loss has been reported. However, under US law, maritime operators could face significant costs if found to have neglected basic cybersecurity, and a major breach could trigger regulatory fines or insurance claims.
- Reputation
- The incidents could damage the reputation of vessel operators, especially as they involved preventable flaws. Publicly traded companies may be particularly sensitive to such events.
- Customers
- For shipping customers, the main risk is disruption to cargo delivery or safety concerns. No such disruption occurred in this case, but the events highlight the importance of cybersecurity in the supply chain.
Why it matters
Ships carry huge amounts of cargo and rely on digital systems for safe operation. If hackers can exploit known flaws, they could disrupt shipping, threaten crew safety, or cause environmental harm. The incidents show that even basic cybersecurity steps like patching are not always followed in critical industries.
How does it work?
Attackers took advantage of known security flaws in the ships' systems that had not been patched. These vulnerabilities were already documented, and fixes were available, but had not been applied. This allowed hackers to compromise the vessels' networks.
Key points
- Two supertankers were boarded by US authorities after cyberattacks exploited unpatched flaws.
- No operational disruption or harm was reported, but the incidents were preventable.
- Modern ships' IT and OT systems are closely linked, increasing cyber risk.
- Most maritime organisations have experienced significant OT cyber incidents in the past year.
- Patching known vulnerabilities is a basic but often overlooked defence.
Sources
BankInfoSecurity
Reference
- Coast Guard Boardings of Hacked Vessels: New Details (opens in a new tab)
bankinfosecurity.com
- Coast Guard Boardings of Hacked Vessels: New Details (opens in a new tab)
