FBI and Coast Guard Confirm Hackers Breached Propulsion System on US-Bound Oil Supertanker

A hacking group breached the propulsion system of a crude oil supertanker bound for the Texas coast this summer, according to U.S. officials cited by Bloomberg in an Oct. 2 report carried by LiveMint. Federal agents boarded the vessel off the Texas coast in late August as the story unfolded.

The ship is the VL Prosperity, a 1,093-foot Liberian-flagged Very Large Crude Carrier capable of hauling roughly 2.3 million barrels of oil, according to CBS News. It departed Egypt's Sidi Kerir terminal on Aug. 1 bound for Galveston, Texas, and public vessel-tracking data shows it slowed near the Strait of Gibraltar around the time investigators say the attack occurred.

What Happened in the Strait

Iran's Mehr News Agency reported on Aug. 20 that the tanker was attacked on Aug. 7 while transiting Gibraltar, citing an unnamed crew member. Mehr alleged hackers breached engine-room systems, cutting engine cooling flow, raising engine speed, and interfering with fuel and lubrication systems. Communications with the ship's U.S. command center went dark for about 30 hours, a detail U.S. officials have since confirmed.

Rob Lee, CEO of industrial cybersecurity firm Dragos, told CBS News the technical details in Iran's account were "spot on" and realistic for this class of vessel, but he cautioned that nobody has publicly confirmed who was actually behind it.

Iran's state media has an obvious interest in publicizing a successful cyberattack on a U.S.-bound tanker amid ongoing tension over shipping lanes. A separate Iranian outlet, Tasnim News Agency, suggested in September the ship could have been turned into a "floating oil bomb" had it not been intercepted, a claim that cybersecurity-insiders.com correctly flagged as speculative and unconfirmed by the actual investigation.

The Boarding

On Aug. 21, a Coast Guard Cyber Protection Team and the FBI's Cyber Action Team boarded the VL Prosperity along with a vessel inspector, according to CBS News and cybersecurity-insiders.com. The team spent four days conducting forensic work across the ship's information technology, operational technology, and satellite communications systems.

Rear Adm. Amy Grable, commander of U.S. Coast Guard Cyber Command, told CBS News in a network-exclusive interview that investigators "did find malicious cyber activity" after assessing the ship's IT and other systems. She said the Coast Guard's central worry is whether IT systems are connected to propulsion, navigation and other systems critical to ship safety. That pathway is what Bloomberg's Oct. 2 reporting says investigators now believe was exploited.

CBS News' headline referenced two energy tankers boarded last month due to cyberattacks, though only the VL Prosperity's details have been made public. The second vessel's identity and the nature of its incident remain unreported in available coverage.

The U.S. is still investigating whether the two incidents are connected and whether Iran or another foreign adversary was responsible, according to CBS News. No formal attribution, charge, or sanction tied specifically to this incident has been announced by U.S. authorities.

The Geopolitical Backdrop

The tanker incident surfaced amid heightened rhetoric between Washington and Tehran over shipping security. Vice President JD Vance told the All-In Summit that a U.S. withdrawal from the Middle East would trigger a "worldwide energy crisis" given continued Iranian targeting of commercial shipping, according to Fox News. Vance said Iranian forces kept targeting vessels "even in the midst of peace negotiations."

President Trump separately claimed Iran's navy and air force have been "decimated," telling reporters nearly 160 Iranian vessels had been sunk and that "not one ship going to Iran has gotten through" a U.S. blockade of Iranian ports, per Fox News.

Market watcher Newsquawk noted that WTI crude settled $1.76 lower at $91.11 per barrel and Brent settled 6 cents lower at $102.25 on the day its report circulated, but cautioned that contained cyber incidents on individual vessels have historically moved freight rates and war-risk insurance more than the flat price of crude. A broader campaign against maritime infrastructure would carry a bigger market risk than a single-ship incident, Newsquawk noted.

What's Unresolved

Grable's team logged 40 to 50 similar cyber-protection missions over the past year, she told CBS News, suggesting this kind of intrusion attempt on commercial shipping isn't rare. What remains unconfirmed: who carried out the Aug. 7 breach, how deep into the ship's control systems they actually got, whether the VL Prosperity's current status near Galveston has changed since cybersecurity-insiders.com reported no injuries, environmental damage, or major operational disruption resulted, and whether the Coast Guard's broader cyber-protection program will get more funding or authority as a result. The FBI has not announced any arrests or named a suspect.