Cyber — 2026-09-20

FBI and Coast Guard Board Two Oil Tankers After Cyberattacks Hit Vessels Bound for Texas

BLUFFormal U.S. attribution of the tanker intrusions to a specific state actor is very unlikely within 90 days, leaving port security and maritime insurance decisions anchored to an unresolved threat picture.

U.S. Coast Guard and FBI teams boarded two U.S.-bound oil tankers in the Gulf of Mexico on August 21 and August 24 after determining their networks may have been compromised by foreign cyber actors 12. One vessel, identified by Iranian state media as the VL Prosperity, a Liberian-flagged supertanker carrying roughly 2.3 million barrels of oil toward Galveston, had lost communications for about 30 hours after an August 7 incident near the Strait of Gibraltar 34. Coast Guard Cyber Command chief Rear Adm. Amy Grable told CBS News that investigators confirmed malicious cyber activity on the vessel's IT systems while checking for links to propulsion and navigation controls 34. A joint Coast Guard-FBI statement said crews cooperated with the boarding teams and that there have been no reports of operational disruptions, vessel instability, or environmental impacts. The U.S. has not publicly attributed either attack to Iran or another actor 12.

Analysis
Formal US attribution of the intrusions to Iran or another state actor is very unlikely within 90 days, since investigators have confirmed only malicious activity on IT systems, and matching tactics to a known actor typically takes weeks to months. Iran's rapid, unverified claims of seizing propulsion and engine controls likely reflect information-operations amplification of a more limited IT-only breach rather than demonstrated capability to hijack a supertanker's operational systems, and such narrative-building complicates rather than speeds forensic attribution. Moderate confidence rests on corroborated primary reporting from ABC News and CBS News on the boardings and joint agency statement, though Security Affairs and TechCrunch add no independent sourcing, and no forensic linkage to a specific actor has been disclosed. Absent formal attribution, the response stays confined to Coast Guard defensive boardings and voluntary industry guidance rather than triggering sanctions or naval transit advisories for Iran-linked shipping lanes.

4 sources