Oil Tankers' Networks Hacked: FBI and Coast Guard Board Ships to Investigate

Overview

According to foreign media reports, the FBI and the U.S. Coast Guard recently boarded two oil tankers headed toward the American coast to investigate cyberattacks on their onboard network systems. One of the tankers reportedly had its navigation and propulsion systems disrupted following the breach.

This incident extends cybersecurity threats beyond traditional IT systems into critical maritime transportation infrastructure, highlighting the vulnerability of industrial control systems — known as OT (Operational Technology) — to cyberattacks.

Why This Attack Is Alarming

Unlike typical data breaches or ransomware attacks, this incident directly targeted a vessel's physical control systems. Malicious interference with navigation and propulsion systems could, in theory, cause course deviations, loss of propulsion control, and other serious consequences — posing a direct threat to maritime safety.

Modern large oil tankers rely heavily on digital systems. From satellite communications and Electronic Chart Display and Information Systems (ECDIS) to engine room automation, every component represents a potential attack surface. When these traditionally isolated OT systems become connected to the internet or satellite links, attackers gain a foothold.

ECDIS — the core of modern vessel navigation — integrates GPS positioning, route planning, and collision avoidance alerts. If tampered with or disabled, crew members could unknowingly sail into incorrect routes or shallow waters. Propulsion control systems (typically based on industrial PLCs or proprietary protocols) fall under the same OT category as ECDIS, and both traditionally operate on closed local networks, physically isolated from external connections. However, as satellite broadband (such as VSAT) has become widely adopted aboard vessels, crew members can access the internet over the same network infrastructure, blurring the boundary between IT and OT networks. If attackers can breach the IT side, they may be able to move laterally into OT networks and issue malicious commands to control systems without operators ever noticing — and that is precisely what makes this incident so dangerous.

Cyber Risks to Critical Infrastructure

Maritime transport carries the vast majority of the world's energy and cargo. Oil tankers, in particular, are central nodes in the global energy supply chain. Cyberattacks against such targets carry potential consequences far beyond economic losses, with implications for energy prices, supply stability, and even geopolitical security.

The joint boarding operation by the FBI and the Coast Guard reflects the high level of concern U.S. authorities have for maritime cybersecurity. The coordinated involvement of law enforcement and maritime security agencies signals that these incidents are now treated as serious security matters requiring an inter-agency response — not routine commercial network failures.

OT (Operational Technology) refers broadly to the hardware and software systems that directly monitor and control physical equipment and industrial processes, fundamentally different from IT systems that primarily handle data. OT systems demand extremely high real-time performance and availability, and were traditionally designed with almost no cybersecurity considerations — many industrial protocols (such as Modbus and NMEA 0183) were built with no authentication mechanisms whatsoever, transmitting data in plaintext. This inherent vulnerability, combined with the long operational lifespan of vessels (an oil tanker can serve for up to 25 years) and the practical difficulty of frequent equipment updates, makes maritime OT systems an attractive target for attackers: high value, low defenses. While the International Maritime Organization (IMO) has required cyber risk management to be incorporated into ship safety management systems since 2021, implementation levels vary widely, and the industry's overall security maturity still has significant room for improvement.

Implications for the Industry

For shipping companies, this incident serves as a wake-up call: cybersecurity must become a core consideration in vessel design and operations, particularly with regard to network segmentation, access control, and continuous monitoring of critical OT systems such as navigation and propulsion.

As vessels become increasingly intelligent, the convergence of IT and OT systems is inevitable — but convergence also means an expanded attack surface. Establishing robust shore-ship collaborative security frameworks, strengthening crew cybersecurity awareness training, and developing targeted incident response plans have become unavoidable imperatives for the industry.

Since official authorities have yet to disclose full investigative details, the identity of the attackers, the methods used, and the ultimate impact remain to be confirmed. This story will continue to be monitored as developments unfold.