--- title: "FBI and Coast Guard board oil tankers after sus… | Firevault" url: https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026 description: "US authorities boarded two foreign-flagged oil tankers in the Gulf of Mexico after indications their networks were compromised by foreign cyber actors. Mark…" lang: en-GB --- News · Breach Analysis · 17 September 2026 # FBI and Coast Guard board oil tankers after suspected foreign cyberattacks on ships entering US waters US authorities boarded two foreign-flagged oil tankers in the Gulf of Mexico after indications their networks were compromised by foreign cyber actors. Mark Fermor on why a ship is a floating lesson in what happens when operational technology is reachable. Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Mark Fermor CTO, CMO & Founder, Firevault 4 min read Share Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026 Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026&text=FBI%20and%20Coast%20Guard%20board%20oil%20tankers%20after%20suspected%20foreign%20cyberattacks%20on%20ships%20entering%20US%20waters%0A%0AUS%20authorities%20boarded%20two%20foreign-flagged%20oil%20tankers%20in%20the%20Gulf%20of%20Mexico%20after%20indications%20their%20networks%20were%20compromised%20by%20foreign%20cyber%20actors.%20Mark%20Fermor%20on%20why%20a%20ship%20is%20a%20floating%20lesson%20in%20what%20happens%20when%20operational%20technology%20is%20reachable. Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026 Image: An oil tanker at night overlaid with a cyan network grid, a magenta intrusion thread running toward the bridge, with a coast guard vessel shining a searchlight in the distance (https://fire-vault.com/news/us-coast-guard-tanker-cyberattacks-2026.jpg) An oil tanker at night overlaid with a cyan network grid, a magenta intrusion thread running toward the bridge, with a coast guard vessel shining a searchlight in the distance Why it matters ## What this means for organisations holding critical data The FBI and the US Coast Guard are investigating suspected cyberattacks on commercial ships entering US waters, after two foreign-flagged oil tankers were boarded in the Gulf of Mexico in August, according to Cybersecurity Dive. The Coast Guard said it boarded the first vessel on 21 August while it sailed toward the United States, with a second, similar boarding confirmed by the FBI on 24 August. Both vessels were oil tankers en route to Texas. A Coast Guard spokesperson said the measures were designed to ensure the integrity of the vessels'' operational and information technology systems following indications that the ships'' networks were compromised by foreign cyber actors. Officials said there were no indications of operational disruption, vessel instability, danger to crew or environmental impact, and credited the ships'' captains, crews and shore-side corporate staff as critical partners in mitigating the threats. The Coast Guard is managing communication with port operators, vessel owners and maritime industry stakeholders to keep port operations running while the investigation continues. ## A ship is an operational technology network with a hull around it A modern tanker is not simply a vessel with some computers aboard. Navigation, propulsion control, cargo management, ballast and safety systems all run on networked operational technology, sitting alongside the crew''s information technology, satellite communications and shore connections. When officials board to verify the integrity of both OT and IT, they are acknowledging the thing the maritime industry has spent a decade resisting: the network is the ship. That is why the boarding detail matters. This was not a forensics image taken remotely or a log review conducted from shore. Federal agents physically went aboard to establish the state of systems they could not otherwise trust. When you cannot be sure what a connected system is doing, physical presence becomes the audit tool of last resort. ## The pattern is familiar The maritime sector has been here before. The 2017 NotPetya attack on Maersk remains the defining example of how quickly a compromised network becomes a compromised operation, halting terminals and forcing a rebuild of tens of thousands of machines. The 2021 intrusion at the Port of Houston showed port infrastructure itself in scope. The US has since tightened Maritime Transportation Security Act requirements, adding mandatory cyber incident reporting and updated training. These boardings suggest the threat has moved from ports to the vessels themselves, and that authorities now treat a suspect network on an inbound tanker the way they would treat suspect cargo: something to be inspected before it reaches the dock. Annie Fixler of the Foundation for Defense of Democracies put the policy question plainly: whether foreign vessels are adhering to minimum cybersecurity standards that would prevent or mitigate such an attack. The boardings are what happens when the answer cannot be taken on trust. ## What organisations should take from this First, every operational environment that touches the internet should be assumed reachable by a motivated adversary. If a tanker in the Gulf of Mexico is a target, so is a plant floor, a clinic or a depot. Second, separate what must be connected from what must merely be kept. Voyage records, maintenance histories, manifests and compliance archives do not need to live on the same reachable networks as live systems. Data that is not online cannot be the beachhead, the leverage or the ransom. Offline Secure Storage (https://fire-vault.com/offline-secure-storage) exists for exactly this class of data: the records an operation must retain but does not need connected. Third, plan for verification, not just prevention. The Coast Guard could board because there was a physical asset to board. Most organisations do not have that option, which makes continuous logging, integrity checking and tested recovery the only stand-ins for certainty. ## Sources - Cybersecurity Dive: FBI, Coast Guard probe suspected cyberattacks on ships entering US waters: https://www.cybersecuritydive.com/news/fbi-coast-guard-probe-cyberattacks-ships-us-waters/830668/ About the author ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. How Firevault would handle this ## A recovery copy an attacker cannot reach Offline Secure Storage® keeps a clean copy of your data on hardware that is physically disconnected, so backup and recovery do not depend on systems an intruder can touch. Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo **Hardware**Your copy sits on dedicated encrypted hardware **Disconnect**Offline by default, connected only when you say so **Recovery**A known-clean copy to rebuild from, on your timetable **Location**Held in a secure Firevault Bunker Related Reading ## You may also find these useful Breach Analysis ### ASOS data breach: stolen customer profiles and a hijacked app notification ASOS confirms customer-data exposure after attackers hijacked its app notifications. What happened, what was taken and why a stolen login can put more than contact details at risk. 12 Oct 2026 14 min https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026 Breach Analysis ### Dyfed-Powys Police confirms cyber attack as staff information may have been compromised Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The force says it has found no evidence that public data was accessed. 25 Sept 2026 3 min https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 Breach Analysis ### FBI investigates claims that hackers stole personnel and applicant data The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed. 22 Sept 2026 4 min https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026 Breach Analysis ### Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later Families of vulnerable children in Wiltshire, Bath and North East Somerset have been told their personal health information may have been accessed in a cyber attack on HCRG Care Group in February 2025, more than 18 months after the incident. 20 Sept 2026 4 min https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026 Breach Analysis ### FBI investigates 153 million drivers licenses put up for sale on a criminal forum A dark web service claimed to be selling scans of more than 153 million drivers licenses, apparently taken from a Louisiana identity verification company used by household names. The FBI has opened an inquiry, and the case shows how long retention turns a routine check into national-scale exposure. 16 Sept 2026 4 min https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026 Breach Analysis ### CenterPoint Energy confirms hackers stole customer data through an exposed API CenterPoint Energy has confirmed that criminals stole customer data through one of its external facing systems, after a threat actor advertised 7.49 million files on a dark web forum. Mark Fermor on what an unsecured API says about the way critical infrastructure treats connected data. 16 Sept 2026 4 min https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026 ## Suggested Reading - What is Offline Secure Storage The foundation of physical disconnection: https://fire-vault.com/how-it-works/offline-secure-storage - Why Offline Secure Storage The case for physical control: https://fire-vault.com/why-oss - Ransomware Defence Hold gold copies offline: https://fire-vault.com/oss-for-ransomware-recovery - Control Physical path control for IT and OT: https://fire-vault.com/solutions/control - Knowledge Vault All articles, guides and whitepapers: https://fire-vault.com/learn/knowledge - Book a Demo See Firevault in action: https://fire-vault.com/demo Back to Knowledge Vault: https://fire-vault.com/learn/knowledge ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026#webpage", "url": "https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026", "name": "FBI and Coast Guard board oil tankers after sus…", "description": "US authorities boarded two foreign-flagged oil tankers in the Gulf of Mexico after indications their networks were compromised by foreign cyber actors. Mark…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/news/us-coast-guard-tanker-cyberattacks-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "FBI and Coast Guard board oil tankers after suspected foreign cyberattacks on ships entering US waters", "item": "https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "FBI and Coast Guard board oil tankers after suspected foreign cyberattacks on ships entering US waters", "description": "US authorities boarded two foreign-flagged oil tankers in the Gulf of Mexico after indications their networks were compromised by foreign cyber actors. Mark Fermor on why a ship is a floating lesson in what happens when operational technology is reachable.", "url": "https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/news/us-coast-guard-tanker-cyberattacks-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/us-coast-guard-tanker-cyberattacks-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/us-coast-guard-tanker-cyberattacks-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/news/us-coast-guard-tanker-cyberattacks-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-09-17T14:00:00+00:00", "dateModified": "2026-09-18T05:36:25.728276+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 635, "keywords": "Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "The FBI and the US Coast Guard are investigating suspected cyberattacks on commercial ships entering US waters, after two foreign-flagged oil tankers were boarded in the Gulf of Mexico in August, according to Cybersecurity Dive. The Coast Guard said it boarded the first vessel on 21 August while it sailed toward the United States, with a second, similar boarding confirmed by the FBI on 24 August. ", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What happened in the Gulf of Mexico?", "acceptedAnswer": { "@type": "Answer", "text": "The US Coast Guard boarded a foreign-flagged oil tanker on 21 August 2026 after indications its networks were compromised by foreign cyber actors. The FBI confirmed a second, similar boarding on 24 August. Both vessels were oil tankers en route to Texas." } }, { "@type": "Question", "name": "Were the ships damaged or crews harmed?", "acceptedAnswer": { "@type": "Answer", "text": "Officials said there were no indications of operational disruption, vessel instability, danger to crew members or environmental impacts. The captains, crews and shore-side corporate staff were described as critical partners in mitigating the threats." } }, { "@type": "Question", "name": "Why did authorities physically board the vessels?", "acceptedAnswer": { "@type": "Answer", "text": "The boardings were designed to ensure the integrity of the vessels'' operational and information technology systems. When a connected system cannot be trusted remotely, physical inspection becomes the only reliable way to establish its state." } }, { "@type": "Question", "name": "Has the maritime sector been targeted before?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. The 2017 NotPetya attack on Maersk crippled terminals worldwide, and the Port of Houston suffered an intrusion in 2021. The US has since strengthened Maritime Transportation Security Act requirements, including mandatory cyber incident reporting and updated training." } }, { "@type": "Question", "name": "What is the risk to operational technology on ships?", "acceptedAnswer": { "@type": "Answer", "text": "Navigation, propulsion control, cargo management and safety systems run on networked operational technology alongside crew IT and satellite links. A compromise of these networks can threaten the vessel itself, which is why authorities treat a suspect ship network like suspect cargo." } }, { "@type": "Question", "name": "What should organisations learn from this incident?", "acceptedAnswer": { "@type": "Answer", "text": "Assume any internet-connected operational environment is reachable by motivated adversaries, separate records that must be kept from systems that must be live by moving archives into disconnected storage such as Offline Secure Storage, and invest in continuous logging, integrity checking and tested recovery so the state of a system can be verified without a physical boarding." } } ] } ] ```