The VL Prosperity Breach: What U.S. Cybersecurity Rules Already Require
On August 21, 2026, U.S. Coast Guard law enforcement, a USCG Cyber Protection Team, a vessel inspector and an FBI Cyber Action Team boarded a 333-meter crude oil tanker in the Atlantic that was later identified through Iranian and open-source reporting as the VL Prosperity, three weeks out from Egypt’s Sidi Kerir terminal and headed for Galveston with roughly 2.3 million barrels of crude. A second 227-meter liquefied petroleum gas tanker, the Kohaku, was boarded three days later in the Gulf of Mexico after a suspected related attack; both vessels were Texas-bound and had earlier transited the Strait of Gibraltar. USCG and FBI found malicious cyber activity and performed incident response, noting no physical damage, environment impacts or crew injuries at the time, while claims that the attacker reached propulsion, navigation and cargo systems came only from Iranian state media.
Why it matters: The incident illustrates the maritime security theme, since United States cybersecurity rules already require measures for vessels and ports.