US Coast Guard Boards Oil Tankers After Reported Cyberattacks in the Gulf of Mexico
The US Coast Guard and FBI boarded at least two US-bound oil tankers in August 2026 after reported network compromises. Iranian media said Liberia-flagged VL Prosperity lost communications for 30 hours. The Coast Guard reported no operational disruption, crew harm, or environmental impact.
The US Coast Guard said that in August 2026 a tanker transiting the Gulf of Mexico was compromised by a cyber intrusion. Coast Guard personnel later boarded the vessel to inspect its networks. The Wall Street Journal reported that at least two tankers bound for the United States were targeted. A Coast Guard spokesperson confirmed the incident. Bloomberg identified one of the ships as VL Prosperity. Iran's Mehr News Agency reported that the vessel lost communications for 30 hours.
The Federal Bureau of Investigation did not respond to a request for comment. The Coast Guard said that after it found the ship's network may have been compromised by foreign cyber attackers, officials boarded to ensure the integrity of vessel operating systems and information technology systems.
Boarding on 21 August
A Coast Guard spokesperson said that on 21 August a specialized team boarded the vessel for a full cybersecurity inspection and investigation. The team included Coast Guard law enforcement personnel, members of a Coast Guard cyber protection team, a vessel inspector, and personnel from an FBI cyber operations team.
The spokesperson said there were no reports of disruption to vessel operations, loss of vessel stability, physical danger to the crew, or environmental impact.
The Coast Guard did not describe the attack in detail, name possible perpetrators, or confirm whether the 21 August boarding involved VL Prosperity. The Wall Street Journal reported that a second ship was boarded on 24 August.
Reports on VL Prosperity
Mehr News Agency reported that VL Prosperity sails under the Liberian flag and was traveling from a port in Egypt to a port in the United States. On 7 August, according to that account, the ship was attacked while transiting the Strait of Gibraltar. A crew member told Mehr that the attackers allegedly raised engine speed and shut fuel and lubricating oil tanks. That claim has not been publicly corroborated.
Mehr cited Russian analysts who linked the incident to military conflict between the United States and Iran. No hacking group has claimed responsibility. Bloomberg reported that VL Prosperity was off the coast of Texas at the time of the later reporting.
North Carolina ports
The day before VL Prosperity was allegedly attacked, the North Carolina Ports Authority reported a cyberattack that forced port operations onto manual processes. A ports authority spokesperson said information technology systems had been compromised by external individuals or groups. The authority activated its emergency plan and contacted several state agencies and the US Coast Guard.
Recent maritime and port incidents
A Coast Guard spokesperson said the service continues to work with port operators, ship owners, and local maritime parties to keep port operations safe and uninterrupted.
Over the past five years, as ports have digitized operations, ports in the United States, Europe, and Asia have been frequent targets of ransomware groups.
In 2024, a cyberattack on the Port of Seattle caused operational problems at the city's airport and seaport around the Labor Day holiday. The Port of Seattle refused to pay a ransom.
In 2023, several European ports and the shipping firms Royal Dirkzwager and DNV were hit by ransomware.
In 2022, oil companies Oiltanking and Mabanaft were compromised and later cited force majeure to pause contract performance. Logistics and freight forwarding firm Expeditors International also suffered a cyberattack that disabled some operational systems for months.
Reference: The Record.