Second Texas-bound oil tanker hit by hackers possibly linked to Iran, FBI confirms both attacks

A commercial tanker carrying nearly 2.3 million barrels of oil and headed to Texas is hit by hackers – forcing the ship to call in the FBI and Coast Guard to help mitigate the breach, now being tied to Iran. New information surfaced Thursday about a second attack on a US-bound tanker.

The FBI on Thursday confirmed two separate vessels were compromised last month, with onboard investigations taking place on August 21st and August 24th.

Furthermore, US officials are “considering whether Iran or an Iran-aligned actor could be responsible,” the Wall Street Journal also reported on Thursday, citing sources familiar with the matter.

In a statement sent to Cybernews on Thursday, a Coast Guard spokesperson said there are “currently no reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts” – referring to the more than three-day incident response operation aboard the unidentified "inbound foreign-flagged commercial vessel.”

One of those vessels, a Liberian crude oil tanker now parked in the Gulf of Mexico, left from Egypt’s Sidi Kerir Oil Terminal on August 1st, with its destination listed as Galveston, Texas, according to the site VesselFinder.

Identified as the VL Prosperity, the 2015 ship measures 333 meters (~1,093 feet) long and has a deadweight capacity of 319,547 tonnes. It was supposed to arrive in Galveston on August 24th.

But instead, three days before its arrival date, we’re now learning that a “highly specialized team” of FBI and Coast Guard cyber experts descended on the vessel after being called in to investigate a major breach of its systems.

“On August 21, a highly specialized team – comprised of USCG Law Enforcement personnel, USCG Cyber Protection Team members, a vessel inspector, and FBI Cyber Action Team operators – embarked the vessel to conduct a comprehensive cyber security boarding and investigation,”

a US Coast Guard spokesperson told Cybernews on Thursday.

The Coast Guard spokesperson said the measures taken as part of the “joint offshore security boarding were designed to ensure the integrity of the vessel’s operational and information technology systems."

This was based on what the Coast Guard said were “indications that the vessel’s network were compromised by foreign cyber actors," later descibing it as "malicious cyber activity."

The video above, released on Wednesday, shows US Coast Guard members assigned to the US Coast Guard Cutter Donald Horsley transferring from the cutter to a tanker and conducting operations aboard the tanker in the Gulf of America on August 24, 2026, and is credited to US Coast Guard Petty Officer 3rd Class Perry Shirzad.

Second Texas-bound tanker hit by hackers

The VL Prosperity breach was reported to have taken place while the vessel was traveling through the Strait of Gibraltar, a major shipping chokepoint that has seen heavier traffic since the Iran War has effectively cut off access to the Strait of Hormuz.

The route may be a significant factor in the attack, as the Wall Street Journal's report – which was later confirmed by the FBI – states that the US is now investigating a second cyberattack on a vessel also bound for Texas and transiting the Strait of Gibraltar.

The Strait of Gibraltar, which connects the Mediterranean Sea with the Atlantic Ocean between Spain and Morocco, sees roughly 300 ships transit the route each day.

The second and slightly smaller tanker – the 227-meter-long Kohaku – was on its way to another Texas port to load liquefied petroleum gas (LPG), the WSJ said.

As of Thursday, the Marshall Islands-flagged LPG tanker appears to be anchored near Malta, VesselFinder shows.

US investigates possible Iran link

The Coast Guard did not name the foreign actor behind the attack, yet Tehran’s state-owned Mehr News Agency was first to identify VL Prosperity as the victim, citing an unnamed crew member on August 20th.

The Mehr report also claimed the attack knocked “all of its communications” offline for 30 hours.

The attackers infiltrated the engine-room systems, reduced the engine’s cooling flow, increased the engine speed, and disabled the ship’s fuel and engine-oil tank,

Mehr News Agency reported.

Ironically, although Mehr stated that “No group had yet claimed responsibility for the incident,” the piece also insinuated that the attack was a message from Iran's "Resistance Front" to Washington and the broader Middle East, warning that “international waters do not have immunity” from further action.

Coast Guard actively monitoring

The US military maritime branch also said it is “actively managing communications with port operators, vessel owners, and local maritime stakeholders to ensure port operations continue safely and without interruption,” confirming that the "threats were mitigated."

The Coast Guard also praised the "extensive cooperation" from the impacted vessel, specifically calling out the tanker’s captain, crew, and shore-side corporate staff.

Maritime partners were further encouraged to “proactively request anonymized cyber assistance,” the Coast Guard said.