Coast Guard and FBI boarded tankers due to cyberattacks. How big is the risk?

U.S. Coast Guard and FBI agents intercepted two energy tankers en route to the United States after cyberattacks targeted them while at sea, according to U.S. officials. The VL Prosperity, an 1,093-foot Liberian-flagged crude oil tanker, was one of the vessels. Iranian state media reported that hackers gained access to the ship's propulsion, navigation, and cargo systems, causing communication disruptions for 30 hours.

While the Coast Guard has not publicly attributed the attacks to Iran, Rear Adm. Amy Grable, commander of U.S. Coast Guard Cyber Command, confirmed they found evidence of malicious cyber activity. The Coast Guard is investigating whether the attacks are connected and whether Iran or another foreign adversary was responsible. The VL Prosperity departed Egypt's Sidi Kerir oil terminal on August 1 and slowed near the Strait of Gibraltar around the time of the cyberattack.

Iranian news agency Mehr News reported on August 20 that the ship was attacked while transiting through the strait. Experts believe the reported details are plausible, but the identity of the attackers remains unknown. The Coast Guard boarded the ship for four days, with FBI Cyber Action Team operators assisting. The investigation focused on identifying and neutralizing malicious software and examining IT systems to detect any compromised systems controlling critical vessel functions.

The potential risks associated with cyberattacks on large cargo vessels are significant, as modern commercial ships rely on internet-connected systems for navigation, propulsion, and other critical machinery. A successful cyberattack could disrupt operations, cause pollution incidents, or pose safety hazards to ports and waterways.

The economic impact of a cyber breach could also be substantial, with $5.4 trillion in commerce passing through U.S. ports annually. The technical barrier to manipulating machinery aboard a modern tanker may not be as high as previously assumed, as malicious source code is readily available, and artificial intelligence can accelerate the process of breaching internet-facing systems on energy carriers.