Bloomberg reported that FBI and US Coast Guard investigators found evidence of temporary unauthorized access to the VL Prosperity’s digital propulsion systems while the Liberian-flagged supertanker, carrying approximately 2.3 million barrels of crude oil, was approaching the Texas coast bound for Galveston. Authorities boarded the vessel on 21 August after it lost communications; Iranian media later claimed the attack occurred on 7 August near the Strait of Gibraltar and lasted 30 hours, with attackers penetrating engine room systems. US officials have not confirmed those details, and attribution remains unclear.
IT/OT convergence as attack surface
The public account from US agencies is cautious: investigators detected malicious cyber activity and spent four days examining systems and working with the crew. Officials stated there were no operational disruptions, vessel instability or dangers to the crew at the time. Rear Admiral Amy Grable of Coast Guard Cyber Command identified the core vulnerability: on many ships, satellite connections, bridge systems and engine-room controllers share networks behind a single firewall. An attacker who compromises an outward-facing link can move into machinery. As analysts quoted in the reporting noted, access is not the same as confirmed control, but the possibility that intruders can reach propulsion and steering controllers is the operational risk.
The operator’s problem
The Prosperity episode exposes a gap the public debate often misses. An embedded system that does not know it has been compromised cannot reliably save itself. Detection and containment matter, but when the legitimate operator can be cut off or spoofed – when the network itself is the point of failure – defenders need an independent way back in.
The Stormfire patent family describes one approach to that problem: an authenticated out-of-band channel that first disables the compromised primary controller, then issues recovery commands (return to port, halt, report position) over the same alternate path. It is a design pattern, not a product, and it fits scenarios where the operator has lost or may lose the ability to command the system through normal channels.
What that looks like in practice: a satellite-equipped vessel under attack over its primary link could receive an authenticated SMS or alternate-band command that physically disconnects the compromised controller and activates a dormant backup reached by a channel the attacker does not control. The operator regains the ability to act.
Segmentation is not enough
Grable recommended that operators segment their networks and follow basic cybersecurity precautions. Segmentation helps, but it does not solve the operator’s problem when an attacker is already inside and the crew cannot tell which systems to trust. The question is not whether the firewall held; it is whether the rightful operator can provably cut the attacker off and take back control when the firewall has failed.
The Coast Guard has signaled stricter scrutiny of foreign vessels’ cybersecurity during Port State Control inspections. The industry now faces a concrete question: can the master and the shore operator regain control of propulsion, steering and navigation when the networks they depend on are no longer trustworthy? The Prosperity incident suggests the answer is not yet clear.
Related coverage: Tanker bound for Texas hit by cyberattack — TrasportoEuropa