Coast guard shifts to cyber crackdown after tanker hacks
The gist
The U.S. Coast Guard is cracking down on maritime cyber threats, shifting from friendly guidance to mandatory enforcement after high-profile tanker hacks rattled the sector.
What to know
- As of mid-2026, all U.S. ports, vessels, and supply chains must undergo mandatory Cybersecurity Assessments and actively reduce cyber risks.
- By late summer, the Coast Guard teamed up with the FBI to board foreign-flagged tankers like the VL Prosperity and Kohaku over suspected cyber compromises.
- This marks a new era of hands-on enforcement, with the Coast Guard treating cyber incidents as operational emergencies—not just paperwork.
From Guidance to Mandates
Federal cyber strategy now demands active vulnerability reduction and real-time incident testing, pushing maritime operators to prioritize hands-on risk mitigation over compliance checklists.
The reason this rule exists now is that federal cyber policy has entered an implementation phase across critical infrastructure, replacing years of broad guidance with mandatory controls, reporting, and direct agency involvement. Analysis notes that after Colonial Pipeline, Washington built “real defenses” through “agency-led coordination, mandatory incident reporting, and stricter rules requiring systems to verify every user and device,” while the EPA “says it has worked directly with hundreds of water systems in the past two years to close known vulnerabilities,” showing a governing model built around active vulnerability reduction, not passive standard-setting.
That same logic now favors maritime rules that force operators to identify and fix the most consequential weaknesses before they become supply-chain disruptions, and to treat cyber readiness as an operational discipline rather than a paper exercise. Marsh’s board-level cyber analysis captures the shift: organizations are being judged on whether they regularly test incident-response plans and on which controls most reduce exposure, with advisers telling clients, “If you've only got $10 to spend, spend it on this one first,” a compliance mindset centered on prioritization, execution, and response readiness.
Cyber Raids on the High Seas
The Coast Guard’s joint boardings with the FBI mark a shift to direct intervention, as cyberattacks on tankers trigger operational shutdowns and force agencies into frontline incident response.
By mid-September, the Coast Guard was no longer acting only as a regulator writing cyber expectations for the maritime sector; it was participating in live investigative operations. As Foundation for Defense of Democracies reported, a September 16 joint statement said the Coast Guard and FBI “boarded the oil tanker in the Gulf of Mexico in August ‘to ensure integrity of the vessel’s operational and information technology systems’ after evidence of network compromise” by foreign cyber actors, a formulation that squarely places the service inside an enforcement response to a suspected intrusion aboard a foreign-flagged tanker.
The operational facts of the tanker case make the enforcement turn even clearer. CyberScoop tied the Coast Guard to FBI boardings of the VL Prosperity and Kohaku in an Iran-linked hack probe, while separate analysis described a 30-hour communications outage aboard VL Prosperity that coincided with disrupted computer-controlled functions, including reduced engine-cooling flow, increased engine speed, and heat generation; according to Foundation for Defense of Democracies, the incidents demonstrate the Coast Guard’s role in incident response and remediation alongside the FBI, consistent with a shift toward active enforcement actions during 2026.
