A cyber incident involving the crude oil tanker VL Prosperity has renewed concerns over the security of operational technology aboard commercial vessels. US investigators reportedly identified unauthorised access to a digital system associated with the tanker’s propulsion environment. The extent of the intrusion remains unclear, but the case highlights the growing exposure of maritime operations to cyber risks affecting safety-critical systems.
US authorities are investigating a cyber incident involving the VL Prosperity, a Very Large Crude Carrier operating under the Liberian flag, after evidence emerged that unauthorised actors had gained access to a digital system linked to the vessel’s propulsion operations.
The incident reportedly occurred while the tanker was approaching the coast of Texas during the summer of 2026. Investigators from the FBI and the US Coast Guard subsequently examined the vessel’s onboard systems. Key details remain unresolved. It is not publicly known how the attackers initially gained access, how long they remained inside the network or which functions within the propulsion environment were technically accessible.
There is also no confirmed evidence that the attackers exercised direct control over the vessel’s engines, speed or manoeuvring capability. That distinction is important. A compromise involving a propulsion-related digital environment represents a serious maritime cybersecurity event, but it should not automatically be equated with full operational control of the vessel.
US authorities examine compromised vessel networks
The VL Prosperity case appears to form part of a broader investigation into suspected cyber compromises affecting commercial shipping in US waters. US authorities had already boarded the tanker in August following indications that its onboard networks may have been compromised. Another commercial vessel was reportedly examined under similar circumstances.
The purpose of the intervention was to assess the integrity of the vessels’ information technology and operational systems. No major disruption to the VL Prosperity’s operations has been publicly reported. There have also been no confirmed reports of loss of vessel stability, damage to the propulsion system or environmental consequences associated with the incident. The absence of an operational accident does not reduce the security significance of the case. Very Large Crude Carriers transport substantial quantities of oil and operate within highly regulated safety environments. A serious compromise involving propulsion, steering or navigation could potentially affect crew safety, port operations, environmental protection and energy supply chains. The incident therefore illustrates why maritime cybersecurity is increasingly treated as an operational safety issue rather than a conventional IT concern.
Growing dependence on connected systems
Commercial shipping has become increasingly dependent on connected digital infrastructure. Modern vessels use networked systems for navigation, propulsion monitoring, power management, cargo operations, communications, remote maintenance and condition monitoring. These technologies provide significant operational benefits. They improve visibility, efficiency, diagnostics and fleet management.
At the same time, every additional connection can introduce new dependencies and potential attack paths. The most significant development is the increasing integration of information technology and operational technology. IT systems are primarily designed to process, store and transmit information. Operational technology controls physical equipment and processes. On a modern commercial vessel, OT can include propulsion, steering, power generation, ballast management, navigation equipment, alarm systems and fire protection. A cyber compromise affecting such systems therefore carries a different risk profile from an intrusion into conventional office IT. A successful attack on administrative infrastructure may lead to data loss, fraud or disruption. An intrusion into operational technology can potentially affect the physical operation of the ship.
Maritime cyber risk becomes physical risk
The distinction is particularly important in the tanker sector. Large oil carriers operate with complex safety systems because an operational failure can have consequences far beyond the vessel itself. Loss of propulsion, reduced manoeuvrability or disruption to navigation can create risks during port approaches, narrow-water operations or adverse weather conditions. If cyber interference contributes to such a scenario, a digital incident can rapidly become a maritime safety event. For vessels carrying hazardous cargo, this also introduces an environmental dimension. A significant incident involving a crude oil tanker could potentially affect coastal infrastructure, port operations and marine ecosystems, while simultaneously disrupting commercial transport routes. This combination of cyber, operational and environmental risk is one reason maritime cybersecurity has moved higher on the agenda of regulators, shipowners and classification societies. It is nevertheless important to avoid overstating the implications of individual incidents. A successful network intrusion does not necessarily allow an attacker to take unrestricted control of a vessel. Commercial ships generally incorporate technical redundancy, local controls and alternative operating procedures intended to preserve essential functions during equipment failures. The effectiveness of those safeguards during a cyber incident depends heavily on system architecture.
Network segmentation becomes critical
One of the most important technical questions following an intrusion is whether attackers can move from the initially compromised system into other areas of the vessel’s network. Effective segmentation between administrative IT, crew networks and safety-critical operational systems can significantly limit the impact of a successful breach.
Weak segmentation can have the opposite effect.
If systems that were originally designed to operate independently become interconnected without adequate controls, an attacker who compromises one environment may gain opportunities to move laterally towards more sensitive systems. Remote-access infrastructure represents another important area of risk. Modern vessels increasingly rely on shore-based technical support, remote diagnostics and vendor maintenance. These services can improve reliability and reduce operational costs, but they also create additional external connections into onboard environments. Authentication, privilege management, logging and strict control of remote access are therefore becoming central elements of maritime cybersecurity. Third-party suppliers are another consideration. Many ship systems are provided and maintained by specialised vendors. As a result, cyber risk extends beyond the shipowner and vessel operator to equipment manufacturers, service providers and software suppliers. The security of the overall system increasingly depends on the security of the maritime supply chain.
Cybersecurity becomes part of vessel design
Regulation has gradually responded to this changing risk environment. Cyber risk has been incorporated into shipowners’ and operators’ safety management obligations under the International Safety Management framework. In parallel, classification societies and industry organisations have introduced more detailed requirements addressing the resilience of ships and onboard systems. The International Association of Classification Societies has developed requirements covering the cyber resilience of new vessels and onboard equipment, including principles related to network architecture, access control, monitoring and recovery. These measures reflect a broader change in approach.
Maritime cybersecurity is increasingly moving from operational IT management into the design and engineering process. Rather than adding cyber controls after vessels have entered service, shipbuilders, system manufacturers and operators are being required to consider security during system architecture and integration. This is particularly relevant for new vessels with highly integrated bridge, machinery and automation environments. Security by design can reduce the risk that a compromise of one system provides direct access to another. It can also improve the ability of crews to maintain safe operations when digital systems become unavailable.
Detection remains a major challenge
Prevention alone is not sufficient. Shipping companies must also be able to identify unusual activity before it develops into an operational incident. Continuous monitoring remains difficult in maritime environments, particularly on older vessels where equipment may have been designed long before cyber threats became a major consideration. Legacy systems can be difficult to patch, may rely on proprietary protocols and may not support modern monitoring tools. Operational requirements can also limit the ability to take systems offline for maintenance or security updates. As a result, anomaly detection and network visibility are becoming increasingly important. Ship operators need to understand normal traffic patterns between onboard systems and identify unexpected connections, commands or data flows. This is particularly important where operational technology is connected to external communications infrastructure. Early detection can make the difference between isolating a compromised system and responding only after operational functions have been affected.
Backup and recovery must include operational systems
Maritime cyber resilience also depends on recovery. Backups are well established in conventional IT environments, but restoring a ship’s operational systems can be significantly more complex. Configuration data, automation settings, navigation information and vendor-specific software may all be required to return equipment to normal operation. Recovery procedures therefore need to be tested rather than merely documented. Shipowners must know which systems are essential for safe navigation and operation, how they can be restored and whether crews can operate critical functions manually if required. This places additional emphasis on crew training. Cyber incidents are not handled exclusively by shore-based security teams.
At sea, the crew may be the first to identify abnormal system behaviour and may need to isolate equipment, switch to alternative systems or initiate manual procedures.
Cybersecurity awareness must therefore extend beyond specialist IT personnel.
Maritime cyber resilience requires operational preparedness
The VL Prosperity incident reflects a wider shift in the maritime threat landscape. Commercial vessels are increasingly connected industrial environments. Their digital infrastructure supports not only administrative functions but systems directly related to navigation, propulsion and safety. For shipowners, operators and port stakeholders, the distinction between cyber risk and physical security is therefore becoming less meaningful. A resilient maritime security strategy must address both. Key measures include effective network segmentation, strong authentication, controlled remote access, continuous monitoring, tested backup and recovery procedures and clearly defined fallback options for safety-critical functions. Incident response plans must also account for the operational realities of ships at sea, including limited connectivity, small onboard teams and dependence on external technical support.
The VL Prosperity case also demonstrates why the industry should avoid focusing exclusively on attribution. Determining who conducted an attack is important for law enforcement and national security. For ship operators, however, the more immediate question is whether onboard systems can contain an intrusion and maintain safe operation even when the attacker remains unknown. That question becomes increasingly important as geopolitical tensions, criminal activity and state-linked cyber operations place additional pressure on transport infrastructure.
From digital compromise to maritime emergency
The broader lesson is straightforward. A modern merchant vessel is not simply a mechanical platform. It is a networked industrial environment in which digital systems increasingly support essential physical functions. That creates efficiency, but it also changes the consequences of cyber compromise. When attackers remain confined to administrative IT, the impact may be serious but predominantly digital. When they reach operational technology, the risk profile changes fundamentally. The possibility that an attacker accessed a system connected to the propulsion environment of a Very Large Crude Carrier is therefore significant even in the absence of evidence that the ship was actively manipulated. For the international maritime sector, the central security question is no longer whether commercial vessels will be targeted by cyberattacks. They already are.
The critical issue is whether shipboard architecture, monitoring and operating procedures can prevent an initial compromise from reaching systems capable of affecting navigation, propulsion or safety. That is the point at which cybersecurity becomes maritime safety — and where a digital intrusion has the potential to develop into a physical emergency.
