Coast Guard, FBI board US-bound foreign tankers to investigate shipboard cyber intrusions

The US Coast Guard and FBI boarded two US-bound foreign tankers in the Gulf of Mexico on August 21 and 24 after indications their networks were compromised by foreign cyber actors. One vessel, reportedly the VL Prosperity, allegedly lost communications for…

The US Coast Guard and FBI conducted joint offshore security boardings of two commercial ships in the Gulf of Mexico on August 21 and 24, 2026, to examine their operational and IT systems following indications that both vessel networks were compromised by foreign cyber actors. The vessels, which were US-bound and reportedly carried oil and natural gas, were boarded by teams including USCG Cyber Protection Team and FBI Cyber Action Team operators. Bloomberg identified one vessel as the VL Prosperity; Iranian state-linked outlet Mehr reported it lost communications for about 30 hours after an August 7 attack while transiting the Strait of Gibraltar, and a crew member alleged the attackers increased engine speed and disabled fuel and engine-oil tanks. No operational disruptions, vessel instability, or environmental impacts have been reported. No group has claimed responsibility; investigators and Russian analysts have linked the incidents to US-Iran tensions, and the Coast Guard has previously investigated 'dark fleets' carrying sanctioned Iranian and Russian oil. Separately, North Carolina Ports reported a cyberattack that forced a shift to manual operations a day before the alleged VL Prosperity attack. Note: CyberScoop reports two ships were boarded (August 21 and 24), while The Record's confirmed details cover the August 21 boarding of one tanker.

• Coast Guard and FBI boarded two US-bound foreign tankers in the Gulf of Mexico on August 21 and 24, 2026, after indications their networks were compromised; The Record confirms the August 21 boarding of one tanker.
• Boarding teams included USCG Cyber Protection Team and FBI Cyber Action Team operators.
• Bloomberg identified one vessel as the VL Prosperity; Iranian state-linked outlet Mehr reported it lost communications for 30 hours after an August 7 attack while transiting the Strait of Gibraltar.
• A crew member alleged attackers increased engine speed and disabled fuel and engine-oil tanks (per Mehr, via The Record).
• The tankers reportedly carried oil and natural gas; no operational disruptions, vessel instability, or environmental impacts have been reported.
• No group has claimed responsibility; investigators and Russian analysts have speculated the attacks are tied to US-Iran tensions, and possible Iranian involvement is under investigation.
• The Coast Guard has previously investigated 'dark fleets' carrying sanctioned Iranian and Russian oil.
• North Carolina Ports suffered a separate cyberattack a day before the alleged August 7 attack that forced a shift to manual operations.