US investigates alleged cyberattacks on tankers in Strait of Gibraltar 

The US is investigating who was behind alleged cyberattacks on two US-bound tankers as they sailed through the Strait of Gibraltar this summer, it was reported on Thursday. 

The two tankers were transiting the strait in August when their systems were allegedly hacked by unknown actors.  

One, the VL Prosperity, was carrying crude oil, while the second ship, named in US reports as Kohaku, was carrying liquefied petroleum gas. 

US media reported that a specialist team led by the US Coast Guard and including agents from the Federal Bureau of Investigation boarded the vessels on arrival in the Gulf of Mexico. 

Reports of the alleged attacks emerged initially in Iranian state media in late August. 

The incidents come amid heightened tensions over shipping through the Strait of Hormuz, the strategically important waterway off Iran’s coast through which a substantial share of global oil supplies passes.  

With maritime traffic there disrupted by conflict in the region, the alleged attacks in the Strait of Gibraltar have raised questions about the vulnerability of other strategically important shipping routes. 

The Iranian reports on the VL Prosperity cited an unnamed crew member claiming hackers breached the engine room, reducing engine cooling flow, increasing engine speed and interfering with fuel systems. 

The US Coast Guard has not attributed the attacks to Iran or any other actor, or identified the vessels boarded by its investigators. 

But Rear Admiral Amy Grable, commander of the US Coast Guard Cyber Command, told CBS News that investigators were hunting for malware and combing through information technology systems to root out malicious activity. 

"They started out by doing an assessment of the information technology and the other systems on board the vessel, and they did find malicious cyber activity,” she told the US network. 

"The real thing we're concerned about is those IT systems being connected to other systems on the ship that control propulsion, navigation and other systems that are critical to the safety of that vessel.” 

CBS reported that the US was investigating whether the two cyberattacks were connected and whether Iran or another foreign adversary was behind the attacks. 

The manager of the VL Prosperity separately confirmed to the Wall Street Journal that US authorities conducted a cybersecurity screening aboard the ship and said the vessel was cleared for normal operations. 

The Strait of Gibraltar is one of the world’s busiest waterways and is transited by around 300 vessels every day, heightening the potential risk posed by a cyberattack on a ship in this region. 

The Chronicle contacted the UK Ministry of Defence and asked whether it was aware of the claims that two vessels had been targeted by hackers while sailing through the strait and what steps it was taking if so. 

The MoD, which does not normally comment on operational matters, did not immediately reply to the request for comment. 

Authorities in Gibraltar have nonetheless previously highlighted the potential risk posed by malicious cyber activity and other hybrid threats. 

Earlier this month, the Gibraltar Contingency Council said it had considered the potential for “malicious cyber activity, sabotage, disinformation and other hybrid activity affecting UK interests, critical infrastructure and strategic locations” as part of its continuous threat assessments, though it added no further detail and did not refer to any maritime incidents. 

It said relevant agencies would continue to monitor developments closely and maintain coordination with UK partners. 

The risk of vessels being targeted by hackers is not new and, last year, the International Maritime Organisation (IMO) issued guidelines for ship operators on maritime risk management.  

“Recognising that a ship's onboard information technology and operational technology systems can be hacked just as easily as systems ashore, and that such security breaches have the potential to do considerable harm to the safety and security of ships, ports, marine facilities and other elements of the maritime transportation system, IMO has taken the initiative to raise awareness across the industry on how to tackle risks by promoting a maritime cyber risk management approach,” the IMO said. 

“The overall goal is to support safe and secure shipping, which is operationally resilient to cyber risks.” 

But a 2025 article in the digital journal Engineering and Technology Reference warned that much of the maritime sector continues to rely on ageing software and hardware that was not designed with cyber security in mind, leaving ships potentially vulnerable to attack.  

The authors, who included engineering and security experts, pointed to earlier successful cyberattacks on navigation systems and said similar weaknesses could affect propulsion and cargo-handling technology, while attackers could gain access through insecure networks, compromised software or devices smuggled aboard.  

The article concluded that better awareness and established cyber security practices could reduce some risks in the short term, but said the sector faced deeper structural weaknesses that would require a different approach to maritime security, particularly as autonomous vessels become more common.