What Happened
US Coast Guard and FBI teams boarded two energy tankers bound for Texas after cyberattacks disrupted onboard systems during their voyage toward the United States. One vessel, the Liberian-flagged VL Prosperity, lost communications for roughly 30 hours after attackers reportedly reached its fuel and engine-speed systems while the ship transited the Strait of Gibraltar in August. A specialized FBI and Coast Guard team spent four days aboard the vessel helping the crew remove the threat from its IT and operational technology systems. Investigators have not confirmed whether the two tanker incidents connect to each other or identified the responsible actor, though Iranian state media claimed credit for one attack. Read more from SecurityWeek.
Why This Matters for Canadian Organizations
Modern tankers and cargo vessels run propulsion, navigation, and cargo systems on internet-connected operational technology, mirroring the IT-OT convergence risk facing Canadian ports, pipelines, and marine terminals in Vancouver, Montreal, and Halifax. Canada moves a large share of its energy exports and imports by tanker, and a successful attack on steering, propulsion, or cargo-handling systems threatens both safety and continuity of supply, not only data confidentiality. The Canadian Centre for Cyber Security has flagged operational technology in the transportation and energy sectors as a high-priority target, and this incident shows exactly what a state-linked actor does once inside a vessel’s network.
What to Do
Marine operators and port authorities should inventory which vessel systems connect to the internet or to shore-based networks, and segment navigation, propulsion, and cargo controls from administrative and crew-facing systems wherever possible. Organizations operating or chartering vessels transiting high-risk waters should establish incident-response arrangements with flag-state authorities and relevant coast guards before an attack occurs, since the four-day onboard response here depended on rapid coordination between the vessel operator and two separate government agencies.
