Coast Guard Boards Hacked Tanker, Stops Short of Blaming Iran

Investigators "did find evidence of a malicious cyber actor" aboard the VL Prosperity, a 1,093-foot crude oil tanker bound for Galveston, Texas, Rear Adm. Amy Grable, commander of U.S. Coast Guard Cyber Command, told CBS News. What her team has not done, three weeks after boarding the vessel, is confirm Iran was behind it, even though Iranian state media claimed the intrusion reached the ship's propulsion, navigation and cargo systems.

That gap between an attacker's own boast and a government's confirmed finding is the story here, not the attack itself. The Coast Guard and FBI spent four days aboard the VL Prosperity, Aug. 21 through Aug. 24, after the tanker was hit while transiting the Strait of Gibraltar on Aug. 7. A second, unnamed Texas-bound tanker was also boarded. Communications on the VL Prosperity went dark for 30 hours; engine cooling flow was reduced and engine speed increased, according to TechCrunch's Sept. 18 report. The Coast Guard found no danger to the crew, no environmental release and no lasting damage to the ship's navigability.

What Grable confirmed, and what she didn't

Grable's public account is narrower than Iran's own claim. She confirmed malicious activity was present on the vessel's systems and that investigators compare "tactics, techniques and protocols that certain adversaries use" to identify who is responsible, without saying that comparison had produced a match. She also offered a caution that widens the suspect pool rather than narrowing it: manipulating ship machinery is "not necessarily that sophisticated," she said, and malicious code for doing so is readily available online, a gap artificial intelligence is now helping close.

Quinton DuBose, a former Coast Guard cyber official, pushed back harder on the scope of the claim in comments to CBS News, expressing skepticism that a full remote takeover of a supertanker's propulsion is realistic and suggesting disruption of individual subsystems is the more plausible threat. Rob Lee, chief executive of industrial-cybersecurity firm Dragos, took the opposite position on plausibility, telling CBS "everything they're saying is very realistic" from a technical standpoint, while adding that authorities still had not identified the attacker as of his comment.

A pattern that started in February, minus one domain

The VL Prosperity attack is the latest in a run of incidents U.S. officials have linked to Iran since the U.S., Israel and Iran fought a war beginning in February 2026.

Month, 2026	Target	Reported impact
Feb.-July	Water and energy providers	FBI, CISA, NSA, EPA, DOE and Cyber Command advisory on breached PLCs
March	Stryker (medical devices)	Handala group wiped employee devices via Microsoft Intune
May	Los Angeles transit system	Weeks-long recovery from the breach
Aug.	VL Prosperity and a second tanker	30-hour communications outage

The joint advisory those agencies issued, first published April 7 and last updated July 22, describes Iranian-affiliated actors exploiting internet-exposed programmable logic controllers from Rockwell Automation, Schneider Electric and Siemens, manipulating displays and disabling safety alarms so that "systems enter unsafe conditions without notifying operators." It says nothing about vessels or maritime systems. If the tanker intrusions are eventually tied to the same campaign, they would mark that campaign's first documented move from static industrial equipment onto something that crosses oceans and national jurisdictions while carrying two million barrels of crude.

The advisory's own mitigations are built for a fixed site: disconnect the controller from the public internet, flip a physical mode switch to the run position, add multifactor authentication, keep offline configuration backups. None of that translates cleanly to a tanker mid-voyage in the Strait of Gibraltar, where the propulsion system cannot be air-gapped without stopping the ship. The same mismatch between advisory language written for stationary industrial equipment and an attack surface that moves showed up when CISA catalogued AI-generated exploit scripts targeting Siemens S7 controllers two months earlier: guidance calibrated for one kind of target does not automatically cover the next one an attacker tries.

What would settle it

Neither the Coast Guard nor the FBI has said whether the two tankers are formally linked to each other, let alone to Iran, and the agencies have offered no timeline for a public attribution decision. The Coast Guard runs 40 to 50 cyber protection team missions a year across a system that moves $5.4 trillion in commerce annually, according to figures Grable gave CBS, which makes two tanker boardings a small fraction of that workload rather than a new standing posture. That steady-state number matters for reading the response correctly: the boarding of the VL Prosperity was routine enough, procedurally, that it did not require a public emergency declaration, the same low-key posture CISA has taken when it has set a hard deadline for a cataloged flaw without publishing a count of who was actually hit.

What is not routine is the target. A supertanker carrying 2.3 million barrels toward a U.S. port is a different kind of asset than a water utility's control room, and the consequence of a successful takeover, rather than a successful disruption, would be measured in a way a spreadsheet of compromised PLCs cannot capture. Dragos's Lee and the former Coast Guard official DuBose disagree specifically on how close this incident came to that consequence, not on whether the underlying access was real; Grable's own account sits between them, confirming the access without endorsing either the scale Iran claimed or the more limited version DuBose thinks is more likely.

The honest description of where this stands is that a U.S. government agency found malicious code on a ship its adversary claims to have seized control of, and is not yet willing to say the adversary is telling the truth about the extent of it. A formal attribution, or a public statement that investigators could not make one, is the next fact that would move this from an open question to a settled one.