Hackers Boarded a Supertanker Mid-Voyage. The FBI Had to Do It Too. Here's What That Means for Every Business.

On August 7th, while passing through the Strait of Gibraltar with 2.3 million barrels of crude oil aboard, the supertanker VL Prosperity was attacked.

Not by pirates. By hackers.

According to reports from Mehr News Agency and U.S. officials, the attackers breached the ship's systems and interfered with the engine cooling flow, increased engine speed, manipulated fuel systems, and cut communications for 30 hours. The VL Prosperity — more than three football fields long and loaded with enough oil to fuel a mid-sized city — was partially in the hands of remote attackers somewhere on the internet.

Two weeks later, on August 21st, the FBI and U.S. Coast Guard climbed aboard the vessel off the Texas coast with a full cyber investigation team. They confirmed what many feared: malicious cyber activity on the ship's IT and operational technology systems. A second vessel, an LNG carrier, was boarded three days later under similar circumstances.

Rear Admiral Amy Grable, commander of U.S. Coast Guard Cyber Command, told CBS News that investigators found malicious activity and spent four days aboard working to eradicate it.

This is not a drill. This is not a theoretical scenario. This is what happens when operational technology — the computers that control physical systems — gets compromised.

Why This Story Matters Far Beyond Ships

You might be thinking: I don't run oil tankers. What does this have to do with my business?

Everything.

The VL Prosperity attack is a window into a category of risk that most organizations have severely underestimated: operational technology (OT) security. OT refers to the hardware and software that monitors and controls physical equipment — manufacturing lines, HVAC systems, building automation, medical devices, power systems, water treatment controls. If it makes something physical happen, it's OT.

For decades, OT systems lived in a bubble. They ran on proprietary protocols, were air-gapped from corporate networks, and were designed by engineers who prioritized reliability over security. Cybersecurity was someone else's problem.

That era is over.

The push for efficiency drove OT systems online — connected to corporate networks, to cloud platforms, to vendor remote access tools. The efficiency gains were real. So were the consequences. Systems designed in the 1990s and 2000s with no concept of network-based threat now have an internet address.

A ship's engine room is an extreme example. But your HVAC control system, your production line PLC, your building access control — these run on the same fundamental assumption: trusted environment, no external threat. When that assumption breaks, the results are physical.

The Attack Pattern Is Familiar. The Target Isn't.

What's striking about the VL Prosperity incident isn't the sophistication of the attack. It's that it worked on a system that directly controls a physical vessel carrying millions of barrels of oil.

Iranian state media was reporting on the attack before U.S. authorities even publicly acknowledged the boarding — a pattern consistent with Iranian-linked threat actors who have repeatedly targeted maritime and energy infrastructure in 2026.

The Coast Guard's Cyber Protection Team has now conducted 40 to 50 such boarding missions in the past year alone. That's not a niche response capacity. That's a standing operational capability, because maritime OT attacks have become frequent enough to warrant one.

And attacks on operational technology systems broadly are surging. The same threat actors targeting water utilities in Minnesota, power infrastructure in the UK, and manufacturing plants across the industrial Midwest are now actively probing maritime systems. The attack surface has expanded because the connectivity has expanded.

The Questions Your Business Needs to Answer

OT security isn't just a shipping or utilities problem. Any organization with physical systems — manufacturing, healthcare, building management, food production, logistics — needs to ask three uncomfortable questions:

First: Do you know what's connected?

Most organizations can tell you what servers and endpoints sit on their corporate network. Far fewer can tell you what OT devices are connected — even indirectly — to systems with internet access. The gap between "what IT knows about" and "what actually has a network path" is where attackers operate. Before you can protect OT systems, you have to know they exist and understand how they're connected.

Second: If your OT systems were compromised, would you know?

IT systems generate logs. Modern endpoints run detection agents. OT systems frequently do neither. A PLC that's been manipulated may look completely normal from the corporate network. The VL Prosperity's crew had communications cut for 30 hours — and even then, the extent of the compromise required four days of forensic investigation to fully characterize. If you're relying on your OT vendor's dashboard to tell you if something's wrong, you're operating blind.

Third: Do your vendors have access to your OT systems — and do you know when they're in?

Remote access is how OT systems became attack surfaces. Most OT vendors need remote access for maintenance, updates, and diagnostics. Most businesses grant it. Many businesses have no visibility into when that access is being used, by whom, or what it's touching. An attacker who compromises a vendor's credentials doesn't need to find your system — your vendor's access tunnel takes them straight there.

The Harder Truth

Here's what the VL Prosperity incident exposes that most security frameworks still dance around: you cannot patch your way out of OT risk.

Many OT systems cannot be patched at all — the vendor no longer supports them, the patch process requires a physical shutdown that operations won't approve, or the system is so embedded in a production process that any change is treated as unacceptable risk. These systems will run unpatched for years, sometimes decades.

That means your OT security strategy cannot be built on the same foundation as your IT security strategy. You cannot assume vulnerabilities will get fixed. You have to assume breach, monitor behavior, isolate segments, and build manual fallback procedures for when a digital system gets taken offline — or taken over.

A supertanker's crew had 30 hours of communications blackout and compromised engine controls in the middle of open water. They didn't sink. But they couldn't call for help either.

What's your manual fallback when a critical system goes dark?

What Smart Organizations Are Doing Right Now

The organizations getting ahead of this aren't waiting for an incident to discover their OT exposure. They're building OT asset inventories — mapping every device that talks to a network, even legacy equipment. They're segmenting OT from IT at the network layer, limiting blast radius when corporate systems are compromised. They're auditing vendor remote access — cataloging every third-party connection, implementing just-in-time access controls, and logging all remote sessions.

And they're testing their assumptions. Tabletop exercises that include OT failure scenarios — not just IT ransomware responses — so that when a physical system misbehaves, the business doesn't freeze.

The FBI doesn't board your building when your factory floor gets hacked. But the consequences can be just as physical.

The Bottom Line

A 1,093-foot oil tanker was partially controlled by remote attackers for 30 hours before anyone on the outside world knew. The FBI and Coast Guard spent four days investigating the aftermath.

If hackers can manipulate the engine room of a supertanker at sea, they can manipulate the operational systems inside your facility — and in most organizations, the detection and response capability is considerably less than what the U.S. Navy brings to a boarding operation.

OT security isn't a future problem. It's today's problem, with yesterday's tools, and most organizations haven't started yet.

If you want to understand where your organization stands, TrustPoint Cyber can help you start with what matters most: knowing what you have, knowing what's exposed, and knowing what to do when something goes wrong.