Coast Guard, FBI boarded Texas-bound oil tanker after ship's network was potentially breached

Coast Guard personnel and FBI agents boarded a Texas-bound commercial oil tanker in the Atlantic last month after determining the ship's network may have been compromised by a foreign actor, the Coast Guard said Tuesday. Iranian state media claimed that hackers obtained control over propulsion, navigation and cargo systems and lost communications for 30 hours.

The Coast Guard did not disclose the name of the ship, but Iranian reports identified it as the VL Prosperity, a massive 333-meter supertanker capable of carrying roughly 2.3 million barrels of oil. Public vessel data shows the Liberian-flagged very large crude carrier was bound for Galveston, Texas. South Korea-based HMM Ocean Service Co., Ltd., which manages the VL Prosperity, confirmed the Coast Guard had boarded the vessel.  

On Aug. 20, Iran's Mehr News Agency reported that VL Prosperity had been attacked and had lost communications on Aug. 7 while sailing from Egypt's Sidi Kerir terminal toward the U.S. Citing an unnamed crew member, Mehr's report alleged that the attackers penetrated engine-room systems, reduced engine cooling flow, increased engine speed and interfered with fuel and lubricating-oil systems. 

According to the Coast Guard, a specialized team of its law enforcement personnel, a vessel inspector, Coast Guard Cyber Protection Team members and FBI Cyber Action Team operators boarded the ship on Aug. 21. The team examined both the vessel's operational technology and information-technology systems and worked with the crew and the ship's corporate operators to eradicate the threat. On Tuesday, the Coast Guard said there were currently "no reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts." 

Unconfirmed reports of the attack first surfaced publicly after the ship passed through the Strait of Gibraltar, between Spain and Morocco.

The risk of penetrating a commercial oil tanker's system goes beyond stolen data or disabled communications. Modern tankers use interconnected operational technology, or OT, to control the vessels — with propulsion, navigation and cargo systems all internet-connected. Though it's unlikely, if a hostile state can reach and even hijack those systems remotely, an attacker could theoretically manipulate a vessel's movement or critical machinery, potentially turning a massive oil tanker into a weapon against a port. 

The U.S. has not provided details on the extent of the possible breach, only confirming there were indications the vessel's network had been compromised. HMM stated that it "has rigorous cyber protocols in place to ensure the safety and security of vessels under our care."

The U.S. has also so far not attributed the possible cyber attack to a specific actor. After Mehr's report, Iranian state media amplified the story in the weeks following the breach, suggesting that the regime was opening a new cyber front in the war with the U.S. Four days after Mehr's report, Iran's Tasnim News Agency published an article with the headline "No American Vessel Is Safe Anymore: Will Cannons Give Way to Codes?"