Coast Guard Boards a Texas-Bound Tanker After a Cyber Hit

Coast Guard and FBI cyber teams boarded a Galveston-bound oil tanker on Aug. 21 after its network showed signs of a foreign hack. The Liberian-flagged VL Prosperity had already gone dark for more than 30 hours near the Strait of Gibraltar.

A second tanker was boarded on Aug. 24. The Coast Guard confirmed the first operation on Sept. 15 and has not named an attacker.

The Boarding Came Before the Port

The team went aboard in the Gulf of Mexico, before the ship could reach a Texas berth, the Coast Guard said. Officers, a vessel inspector, Cyber Protection Team members, and FBI Cyber Action Team operators climbed onto a foreign-flagged commercial vessel whose network, the agencies said, had been compromised by foreign cyber actors.

The stated aim was to check both the ship’s information-technology systems and the operational technology that moves a tanker, then clear the threat with the crew and the company ashore. Crew members cooperated and were called “critical partners in helping to ensure the threats were mitigated.”

Currently, there are no reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts.

U.S. Coast Guard, Sept. 15, 2026

That line is the official floor. It does not erase the boarding itself. Washington treated an inbound crude carrier as a live cyber scene while the ship was still making for the U.S. coast, 25 days before the Coast Guard would discuss the case in public.

VL Prosperity Is Still Anchored off Galveston

The Coast Guard did not name the ship. HMM Ocean Service Co., Ltd., a South Korea-based manager, later confirmed that VL Prosperity was the vessel boarded. The firm said it “has rigorous cyber protocols in place to ensure the safety and security of vessels under our care.”

Public registries list VL Prosperity as IMO 9683697, a crude tanker built in 2015, 333 meters long and 60 meters wide, with a deadweight of 319,547 tonnes. Iranian state media put her cargo capacity at roughly 2.3 million barrels. She left Egypt’s Sidi Kerir oil terminal at 02:48 UTC on Aug. 1, bound for Galveston, with an arrival window of Aug. 24 at 09:30.

VL PROSPERITY AT A GLANCE

Her AIS track off Galveston still showed the tanker at anchor in the Gulf of Mexico on Sept. 16, draft 21.0 meters, destination unchanged. A full VLCC often lightering offshore rather than nosing into a shallow berth, so the long stay is not proof of a seizure. It is proof the ship that lost comms at Gibraltar spent weeks on the Texas energy doorstep while federal cyber teams worked the case.

What the Cyber Team Looked At

The boarding mixed sea cops with network hunters. That mix is the tell. A radio outage can be a satcom fault. A suspected foreign intrusion on a loaded VLCC is a port-entry problem, because propulsion, steering, and cargo gear now share networks with email and charts.

WHO WENT ABOARD ON AUG. 21

• Coast Guard boarding officers: Law-enforcement personnel who can take control of a vessel in U.S. waters.
• A vessel inspector: A marine-safety specialist looking at physical plant, not just laptops.
• Cyber Protection Team: Coast Guard operators trained to assess, hunt, and do incident response on marine systems.
• FBI Cyber Action Team: Federal investigators who treat the network as a crime scene.

They examined operational technology and information technology together, the Coast Guard said, and worked with the crew and shore staff to oust the threat. The service’s own deployable Cyber Protection Team is built for that job, with units in Washington, D.C., and Alameda, California. About 90% of U.S. imports and exports move by ship, and Coast Guard Cyber Command puts some $5.4 trillion of commerce through the marine transportation system.

The IMO maritime cyber risk guidelines already tell flag states to treat cyber risk inside safety-management systems. The boarding is what that paper looks like when a loaded tanker is pointed at a U.S. oil port and the network may already be someone else’s.

Thirty Hours of Silence at Gibraltar

U.S. officials said the hacked ship was in the Strait of Gibraltar when she was hit and lost communication for more than 30 hours. Iranian state media reported the same blackout on Aug. 20 and dated the attack to Aug. 7, while VL Prosperity was on the Sidi Kerir-to-United States run.

The Iranian account, citing an unnamed crew member, went further than Washington has. It said attackers got into engine-room systems, cut cooling flow, raised engine speed, and knocked out fuel and engine-oil tank monitoring. No group claimed the job. The U.S. has confirmed only “indications” of a compromised network and has not described propulsion or cargo control being taken over.

On Aug. 24, Iranian state media ran a headline that framed code as a substitute for naval guns: “No American Vessel Is Safe Anymore: Will Cannons Give Way to Codes?” That is a war message, not a forensics report. It still matches the geography. The ship was not struck in the Strait of Hormuz. She was hit on the Atlantic approach, then boarded off Texas.

FROM SIDI KERIR TO THE GULF OF MEXICO

1. Aug. 1, 2026: VL Prosperity leaves Sidi Kerir, Egypt, bound for Galveston.
2. Aug. 7, 2026: Iranian state media later dates a cyberattack on the tanker in the Strait of Gibraltar, with a 30-hour comms cut.
3. Aug. 20, 2026: The Iranian report is published; no group claims the attack.
4. Aug. 21, 2026: Coast Guard and FBI teams board the inbound ship in the Gulf of Mexico.
5. Aug. 24, 2026: A second tanker is boarded; VL Prosperity’s listed Galveston arrival window falls on this date.
6. Sept. 15, 2026: The Coast Guard confirms the Aug. 21 boarding after questions about the ship.
7. Sept. 16, 2026: HMM Ocean Service confirms the boarded vessel is VL Prosperity; AIS still shows her at anchor.

A 30-hour blackout is not a spill and it is not a fire. It is also not “nothing happened.” For a VLCC, loss of satcom and radio isolates the bridge from the owner, the charterer, and anyone who would notice a course or plant alarm. The U.S. statement and the Iranian engine-room story can both be on the table because they are not the same claim. One is a safety outcome. The other is an alleged method.

The Second Ship Still Has No Name

People familiar with the inquiry said a second tanker hit by a cyberattack was boarded on Aug. 24 for a similar check. The FBI put the two boardings on Aug. 21 and Aug. 24. Officials described the cargoes as oil and liquefied natural gas. The Coast Guard and FBI said the inspections were meant to protect the integrity of operational and information-technology systems after signs that the networks of both vessels were compromised.

Both ships, officials and tracking data indicated, had transited the Strait of Gibraltar earlier in August. That pairing, Gibraltar plus a U.S. energy port, is why investigators are asking whether someone tried to jam a chokepoint and a discharge port on the same voyage pattern. The agencies have declined to say how many tanker cyber cases they have opened since the war with Iran began.

WHAT WE KNOW

• Two boardings: Federal teams went aboard inbound tankers on Aug. 21 and Aug. 24 in the Gulf of Mexico.
• One named ship: HMM Ocean Service confirmed VL Prosperity as the Aug. 21 case, a Liberian VLCC bound for Galveston.
• Safety line: The Coast Guard reports no injuries, no instability, no spills, and no operational disruptions on the named ship.

WHAT IS UNCONFIRMED

• The attacker: U.S. agencies have not attributed the intrusions; officials are examining Iran or another actor using the war.
• The second hull: No owner, flag, or ship name has been released for the Aug. 24 boarding.
• Engine-room control: Iranian state media’s cooling, throttle, and tank-monitor claims have not been adopted by the Coast Guard.

Officials are investigating whether Iran, or someone trying to exploit the U.S.-Iran war, was involved. Iranian outlets amplified the VL Prosperity account for weeks. Amplification is not attribution. The gap is the story the market has to live with: a loaded energy ship can be boarded as a cyber case on the way into Texas, and the public still will not be told who did it.

Gulf Oil Now Runs Through Gibraltar

VL Prosperity did not load in the Persian Gulf. She loaded at Sidi Kerir, the Mediterranean end of Egypt’s SUMED system, then ran west through Gibraltar toward Texas. That is a wartime routing problem as much as a cyber one.

Israel and the United States began strikes on Iran on Feb. 28, 2026. A UK parliamentary briefing, citing World Trade Organization tracking, recorded a 95 percent drop in Gulf crude sailings and a 99 percent drop in LNG sailings from Feb. 28 through June 1. Ships that still move oil toward the Atlantic have leaned on pipelines, the Red Sea, Suez, and Mediterranean load ports instead of a clear run out of Hormuz.

The kinetic war did not stay in that briefing’s spring window. On Sept. 9, Iran said it had attacked 10 ships near Hormuz after the United States sank five Iranian tankers, and Brent crude rose above $100 a barrel. VL Prosperity’s blackout was already a month old by then. The cyber boarding off Texas sits on the other side of that map: barrels that left Egypt, not Kharg, and still drew a U.S. cyber team.

If the point of a missile is to stop a hull, the point of a network hit on a Gibraltar transit is to show that the workaround route is watched too. Master mariners who saw the first Iranian report described a strike on the ship’s control network, not the hull. That reading fits the boarding better than a satcom glitch. You do not put an FBI cyber team on a ladder to reset a router.

Cyber Teams Already Boarded Dark Fleet Ships

The VL Prosperity case is unusual because the ship was a cooperating commercial VLCC headed for a U.S. port, not a sanctions runner being seized. The tactic is not brand new. Coast Guard Cyber Command’s fifth annual marine-environment report said that in 2025, Cyber Protection Teams deployed with law-enforcement boarding parties on Dark Fleet boarding operations for the first time and took “cyber positive control” of seized tankers’ digital systems.

COAST GUARD CYBER NOTES FROM 2025

• New mix: Cyber Protection Teams rode with tactical boarding teams on Dark Fleet tanker interdictions.
• Phishing: In CPT missions, operators broke into an operator’s system 53 percent of the time with a simple phishing attack.
• Passwords: Teams cracked 4,605 passwords, including 28 privileged or service accounts, and found 273 known exploitable vulnerabilities.
• AI tools: CPTs ran seven missions against networks that used AI cyber platforms and warned that buying the tool is not the same as locking the network.

Those findings were about 2025 industry visits and seizures. They explain why a Galveston-bound VLCC in 2026 got the same ladder: once you have practiced taking digital control of a tanker, you use that skill when an inbound energy ship shows a foreign foothold. The Coast Guard said it is talking with port operators, owners, and local marine stakeholders so port work can continue.

On Sept. 16, AIS still listed VL Prosperity at anchor in the Gulf of Mexico, draft 21.0 meters, destination Galveston. The Coast Guard has not said who compromised her network, and the second tanker still has no public name.