Security Reports disagree 3 publishers 3 min read Published Sep 17, 2026, 12:10 PM PDT

Coast Guard cyber teams found malicious activity aboard Texas-bound tanker and second vessel in Gulf of Mexico

Coast Guard Cyber Command says its teams found malicious cyber activity aboard both hulls after offshore boardings in the Gulf of Mexico, while the engine-room manipulation and the 30-hour communications outage rest on one Iranian state media report.

The Watch · Security desk

Send a correction

What happened

Coast Guard and FBI teams carried out joint offshore boardings of two US-bound commercial ships in the Gulf of Mexico on Aug. 21 and Aug. 24 after indications that both vessels' networks were compromised.
One ship was the VL Prosperity, a 1,093-foot Liberian-flagged crude supertanker carrying about 2.3 million barrels of oil to Galveston, Texas.
Iran's Mehr News Agency reported on Aug. 20 that intruders had reached the engine room on Aug. 7 near the Strait of Gibraltar, slowing coolant flow, raising engine speed and interfering with fuel delivery.
The agencies' joint statement reported no operational disruptions, vessel instability, physical danger to crews or environmental impacts, and said port operations were continuing without interruption.

Why it matters

What doesn't add up contradiction An owner reading the Iranian account and an owner reading the joint statement get two different incidents: engine-room manipulation on one side, no operational disruption on the other, with no US attribution to settle which is closer.
What it costs cost A network-compromise indication on an inbound hull now buys four days of federal investigators aboard a laden supertanker, and the owner and charterer absorb the schedule.
What it sets up precedent US agencies will now put boarding teams on foreign-flagged vessels offshore on compromise indications alone, using authorities granted by the 2024 executive order.

Next story · Security · Aug 26

Feds say Siemens S7 controllers are already being probed, and the fix list is not a patch

Confirmed2 publishers

The engine-room interference and the roughly 30-hour communications outage rest on Mehr News Agency's Aug. 20 report, sourced to an unnamed crew member ^[24]^[25]. Iranian state media was circulating the story before US authorities acknowledged the boarding ^[15]. Mehr published 13 days after the date it gave for the attack ^[22].

The Coast Guard has not publicly linked either attack to Iran, and investigators are still working out whether the two incidents are connected ^[5]. "They started out by doing an assessment of the information technology and the other systems on board the vessel, and they did find malicious cyber activity," Grable told CBS News ^[8]. She said nothing found during the inspection suggested the tanker was unsafe to operate ^[9]. The boarding party arrived on Aug. 21, one day after Mehr published, and stayed four days ^[3]. The second ship was boarded on Aug. 24, according to The Wall Street Journal ^[4].

Quinton DuBose, a former Coast Guard cyber official, disputed the idea that hackers could take full command of a supertanker and said the realistic risk is degrading enough individual systems to make safe operation difficult, SecurityWeek reported ^[11]. He urged caution about the Iranian coverage, noting that Iran-linked actors have a history of overstating their cyber capabilities ^[26]. The Wall Street Journal reported in June that Coast Guard cyber teams have been investigating dark fleets carrying sanctioned Iranian and Russian oil, which rely on digital masking and carry enhanced cyber risk ^[14].

Aboard, the teams hunted for malware and looked specifically at whether the vessels' IT systems were connected to propulsion, navigation and other critical safety systems ^[20]. On some vessels, according to Security Affairs, satellite internet is separated from those systems by little more than a firewall, with navigation, propulsion, steering and ballast sharing one network ^[21].

Grable put the boarding among roughly 40 to 50 missions the Coast Guard's Cyber Protection Team has run in the past year ^[10]. That is a vessel every seven to nine days ^[18]. She also said about $5.4 trillion in commerce moves through US ports annually ^[17], which works out to close to $15 billion a day ^[23]. "Of course we're worried about a collision, an explosion, anything that blocks the channel for other vessels to safely enter and exit the port, pollution incidents," Grable said ^[19].

The boardings came days after the Coast Guard announced an Office of Maritime Cybersecurity Policy as its central authority for cyber safety and security policy across the marine transportation system ^[12]. Its authority to respond offshore dates to an executive order signed in 2024, which cited the risk that a maritime cyber incident could cause cascading harm to the global supply chain ^[13].

What to watch

Whether the Coast Guard and FBI say the two intrusions are linked, and whether either is attributed to a state actor.
Whether the Coast Guard publishes indicators or a marine safety information bulletin drawn from the two boardings.
Whether the new Office of Maritime Cybersecurity Policy sets IT-to-OT segmentation expectations for vessels calling at US ports.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence66
Adoption58
Hype gap+34
Incentives72
Confidence68

Perspective Coverage

3 publishers

Builder: Builder 22%
Operator: Operator 51%
Investor: Investor 27%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
The Coast Guard and FBI conducted joint offshore security boardings of two foreign commercial vessels bound for the United States, in the Gulf of Mexico, on Aug. 21 and Aug. 24, designed to ensure integrity of the vessels' operational and information technology systems following indications that the networks of both vessels were compromised, according to a joint statement from the agencies released Wednesday.
Reported SupportedView cited source
[2]
The joint statement said the boardings "were designed to ensure integrity of the vessel's operational and information technology systems following indications that the networks of both vessels were compromised."
Reported SupportedView cited source
[3]
One day after Mehr's report, a team that included Coast Guard cyber specialists, law enforcement, a vessel inspector and FBI Cyber Action Team members boarded the VL Prosperity and spent four days aboard.
Reported SupportedView cited source
[4]
The Wall Street Journal reported that the second ship was boarded on August 24; both vessels were boarded after they arrived in the Gulf of Mexico.
Reported SupportedView cited source
[5]
The Coast Guard has not publicly pinned the attacks on Iran, and the US is still working to determine whether the two cyberattacks are connected and whether Iran or another foreign adversary was behind them.
Reported SupportedView cited source
[6]
One of the ships was the VL Prosperity, a 1,093-foot Liberian-flagged crude oil supertanker headed to Galveston, Texas, carrying about 2.3 million barrels of oil.
Reported SupportedView cited source
[7]
The VL Prosperity left Egypt on August 1 en route to Galveston, Texas, per vessel-tracking records cited by CBS News.
Reported SupportedView cited source
[8]
"They started out by doing an assessment of the information technology and the other systems on board the vessel, and they did find malicious cyber activity," Rear Adm. Amy Grable, commander of U.S. Coast Guard Cyber Command, told CBS News.
Reported SupportedView cited source
[9]
Grable said nothing uncovered during the inspection suggested the tanker was unsafe to operate.
Reported SupportedView cited source
[10]
Grable said the boarding was one of roughly 40 to 50 missions the Coast Guard's Cyber Protection Team has undertaken in the past year.
Reported SupportedView cited source
[11]
Quinton DuBose, a former Coast Guard cyber official, pushed back on the idea that hackers could seize full command of a supertanker, arguing the more realistic risk is an attacker degrading enough individual systems to make safe operation difficult.
Reported SupportedView cited source
[12]
The incident came days after the US Coast Guard announced a dedicated Office of Maritime Cybersecurity Policy, which will serve as its central authority for developing and implementing policies governing the cyber safety and security of the marine transportation system.
Reported SupportedView cited source
[13]
Then-President Joe Biden signed an executive order in 2024 giving the Coast Guard additional authorities to respond to cybersecurity incidents, citing the risks that a maritime cyber incident could cause cascading harm to the global supply chain.
Reported SupportedView cited source
[14]
Coast Guard cyber teams have been investigating dark fleets carrying sanctioned oil from Iran and Russia, which rely on digital masking to hide their operations and carry enhanced cyber risks, The Wall Street Journal reported in June.
Reported SupportedView cited source
[15]
Iranian state media began pushing content around the VL Prosperity incident before US authorities acknowledged the boarding.
Reported SupportedView cited source
[16]
The joint statement said: "Currently, there are no reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts," and that the Coast Guard is managing communications with port operators, vessel owners and local maritime stakeholders to ensure port operations continue safely and without interruption.
Reported SupportedView cited source
[17]
Grable said about $5.4 trillion in commerce flows through US ports annually, so even a small disruption can cause major delays.
Reported SupportedView cited source
[18]
Roughly 40 to 50 Cyber Protection Team boardings in a year is one vessel every seven to nine days.
Derived Supported
[19]
"Of course we're worried about a collision, an explosion, anything that blocks the channel for other vessels to safely enter and exit the port, pollution incidents," Grable said.
Reported SupportedView cited source
[20]
Investigators hunted for malware and combed through IT systems to root out malicious activity, with a particular focus on whether those IT systems were connected to propulsion, navigation and other critical safety systems.
Reported SupportedView cited source
[21]
In some vessels, satellite internet may be separated from critical systems by little more than a firewall, with navigation, propulsion, steering and ballast sharing the same network.
Reported SupportedView cited source
[22]
Mehr's report came 13 days after the date it gave for the attack.
Derived Supported
[23]
About $5.4 trillion a year through US ports is close to $15 billion a day.
Derived Supported
[24]
Iran's Mehr News Agency reported on August 20 that the cyberattack had allegedly occurred on August 7 as the tanker passed through the Strait of Gibraltar, and, citing a crew member, said the intrusion reached the engine room, with hackers slowing coolant flow, raising engine speed and interfering with fuel delivery.
Reported ContestedView cited source
[25]
The Iranian report also alleged the hackers accessed navigation and cargo systems and cut off the ship's communications for roughly 30 hours.
Reported ContestedView cited source
[26]
DuBose urged caution around the Iranian coverage, noting that Iran-linked actors have a history of overstating their cyber capabilities.
Reported ContestedView cited source
[27]
The vessels were reportedly tankers carrying oil and natural gas, and the first was hacked in the Strait of Gibraltar and lost communication for over 30 hours.
Reported ContestedView cited source

Sources

3 independent publishers whose own reporting we read for this story.

cyberscoop.com
1 article · September 16, 2026
Coast Guard, FBI board foreign ships coming to US to probe cyberattacks
securityaffairs.com
1 article · September 17, 2026
Cyberattacks on Oil Tankers Put Maritime Critical Infrastructure at Risk
securityweek.com
1 article · September 17, 2026
Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder22%

For anyone building or securing shipboard systems, the usable detail is thin but pointed. Security Affairs is the only one of the three to describe what the boarding teams actually looked for: malware in the IT estate, and then whether that estate touched propulsion, navigation and other safety systems. It also carries the line that matters most technically, that on some vessels satellite internet is separated from navigation, propulsion, steering and ballast by little more than a firewall. SecurityWeek adds the entry paths it lists: WiFi, HF radio, SATCOM, an infected USB stick. Neither says which of those, if any, was the path aboard the VL Prosperity.

Operator51%

Operators get a clear picture of the response and a murky one of the incident. All three sources agree on the dates, the agencies involved and the fact that Grable's teams found malicious activity. CyberScoop carries the agencies' own assurance that there were no operational disruptions, no vessel instability and no environmental impact, and that the Coast Guard is talking to port operators and vessel owners. Grable told CBS News nothing found aboard suggested the tanker was unsafe to operate. Set against that, the dramatic operational damage — coolant flow slowed, engine speed raised, fuel delivery interfered with — comes from one Mehr News Agency report quoting one unnamed crew member. Grable's other number is the one operators should note: 40 to 50 of these boardings in a year, roughly one every week to nine days.

Investor27%

The financial framing rests on a single sourced figure, Grable's $5.4 trillion of annual commerce through US ports, which Security Affairs alone carries. That is close to $15 billion a day, and she pairs it with the scenarios she says worry her: a collision, an explosion, a blocked channel, pollution. No source puts a cost on these two incidents, and the agencies say there was no disruption to price. CyberScoop's contribution here is regulatory: the 2024 executive order expanding Coast Guard incident-response powers, and a new Office of Maritime Cybersecurity Policy that arrived days before the boardings became public. Both put compliance obligations on owners and operators.