Scope
In September 2026, U.S. Coast Guard personnel and FBI agents boarded two energy tankers bound for Texas after cyberattacks struck the vessels mid-Atlantic. One attack, on the VL Prosperity supertanker, disabled propulsion, navigation, and cargo systems for 30 hours. The incident reveals a critical vulnerability: modern ships rely on internet-connected systems to control machinery that—if compromised—could block shipping channels, disrupt supply chains, cause environmental disasters, or enable economic warfare.
Small businesses often assume critical infrastructure attacks don't affect them. That assumption is wrong. Supply chain disruptions cascade. Port delays compound. Shipping bottlenecks raise costs. And the same vulnerabilities that affected a 1,093-foot supertanker exist in smaller vessels, manufacturing facilities, and energy systems your business depends on.
This article covers what happened with the tankers, why the attack succeeded, what the Coast Guard discovered, how AI is accelerating these threats, and most importantly: what small businesses should do to protect themselves from supply chain attacks and the growing risk of critical infrastructure compromise.
What Happened: The VL Prosperity Attack
The VL Prosperity is a supertanker—more than three football fields long and capable of carrying 2.3 million barrels of crude oil. On August 7, 2026, while transiting the Strait of Gibraltar, hackers breached the ship's systems. According to Iranian media (which claimed responsibility, though the U.S. has not publicly attributed the attack), the hackers gained access to the engine room, reducing engine cooling flow, increasing engine speed, and interfering with fuel systems. Communications were knocked out for 30 hours.
On August 21, Coast Guard Cyber Protection Teams and FBI Cyber Action Teams boarded the ship for four days. They were looking for malware and assessing damage to IT systems connected to critical operational machinery—propulsion, navigation, steering, ballast systems. This was one of 40-50 such missions the Coast Guard's cyber teams have conducted in the past year, indicating this is not an isolated incident.
Rear Admiral Amy Grable, commander of U.S. Coast Guard Cyber Command, told CBS News: "The real thing we're concerned about is those IT systems being connected to other systems on the ship that control propulsion, navigation and other systems that are critical to the safety of that vessel."
Why This Attack Succeeded
The attack succeeded because of three fundamental security failures that are common across critical infrastructure—and increasingly present in small businesses:
1. A Single Firewall Separating Internet from Critical Systems
On many modern ships, the barrier between a satellite internet connection and critical onboard systems is a single firewall. Behind that firewall: navigation, propulsion, ballast, steering, ship command—all on one shared network. A firewall is a weak substitute for real network segmentation.
Rob Lee, CEO of Dragos (an industrial cybersecurity firm), explained: "Behind that firewall can be a shared network containing navigation, propulsion, ballast, steering, ship command—everything on one shared network." If an attacker penetrates that firewall, they have access to every critical system.
2. Internet-Facing Systems with Minimal Hardening
Modern vessels rely on satellite communications and internet connectivity for navigation, weather updates, and operational communications. These systems often connect directly to critical machinery with minimal hardening or authentication. An attacker doesn't need to be particularly sophisticated—they can use publicly available malicious code.
Grable said: "Not necessarily that sophisticated. There is malicious source code that people can get their hands on." The technical barrier to attack is lower than the public assumes.
3. Operators Prioritize Connectivity Over Isolation
Ships need to communicate with shore-based operations, receive weather data, and report their location. This operational necessity created the vulnerability. Systems that control propulsion and navigation are connected to systems that face the internet. This is common across critical infrastructure: energy grids, water treatment, manufacturing, and healthcare systems all face the same pressure to be connected and accessible.
Why This Matters to Small Businesses
At first glance, an attack on a supertanker seems like a problem for maritime companies, not small businesses. That's a dangerous misunderstanding.
Supply Chain Disruption = Your Problem
$5.4 trillion in commerce flows through U.S. ports annually. A single compromised vessel or blocked shipping channel creates cascading delays. Containers sit longer at ports. Delivery timelines slip. Shipping costs spike. Your suppliers can't deliver on time. Your customers don't receive orders. The economic impact of a "small" port disruption is enormous.
Grable noted: "Any small delay, because of a cyber breach, like, for example, if a port has to shift to manual operations, it causes a big delay with tankers and cargo vessels coming in and out of the port."
You Likely Depend on Critical Infrastructure
If you receive shipments, you depend on ports. If you use electricity, you depend on energy grids. If you rely on water or fuel, you depend on infrastructure vulnerable to the same attacks. If a major energy facility or port is compromised, your business feels the consequences within hours or days.
The Vulnerability Pattern Is Universal
The same vulnerability that affected the VL Prosperity—internet-connected systems with minimal segmentation controlling critical machinery—exists in smaller vessels, manufacturing facilities, water treatment plants, and energy systems. Small businesses with connected operational technology (machinery controlled by networked systems) face identical risks.
The Real Threat: "Remote Hijacking" and System Disruption
When told that cyberattacks on ships could amount to "remote hijacking," Grable said: "That's a good way to characterize it, and yes, it is a concern."
The scenario is realistic if an attacker gains a foothold. Rob Lee (Dragos CEO) agreed: "I do think there's a realistic concern," describing the possibility of remotely disabling navigation, propulsion, or steering systems—potentially running the vessel aground or into another ship.
However, former Coast Guard cyber official Quinton DuBose offered important nuance: "I'd be kind of cautious about saying that somebody can just take control of the ship. Ships are incredibly complicated systems." The more realistic threat is an attacker disrupting one or more critical subsystems enough to make the vessel unsafe.
The same principle applies to other critical infrastructure and to operational technology in small businesses. An attacker may not need full control—just enough disruption to cause damage, financial loss, or safety risk.
AI Is Accelerating These Attacks
The tanker incident reveals another concerning trend: artificial intelligence is making these attacks easier and faster to execute.
Lee warned: "The very thing that we think is our one protection—not that you should have one protection—is the very thing that AI is actually really good at." AI tools are excellent at identifying weakly protected systems, finding network paths, and automating the reconnaissance and initial breach phases of an attack.
Grable echoed this: "Artificial intelligence is accelerating the rate at which we need to take action."
The implication is clear: the technical barrier to attacking critical infrastructure continues to drop. An attacker no longer needs deep expertise in ship systems or industrial control systems—AI can do much of the reconnaissance and attack planning automatically.
What Investigators Found—and Didn't Find
When Coast Guard and FBI teams boarded the VL Prosperity, they were hunting for malware and malicious activity in both IT and operational technology systems. Their goals were to:
- Assess the damage and verify the vessel was safe to operate
- Collect forensic evidence for attribution (identifying who conducted the attack)
- Provide recommendations for vulnerability patching and hardening
The key finding: they did not discover evidence suggesting the ship had become unsafe to navigate when they boarded. The crew had regained control of systems before law enforcement arrived. This matters because it shows the attack was disruptive but not catastrophic—and that time and manual intervention can restore safety.
Attribution remains ongoing. While Iranian state media claimed responsibility, Grable noted that attribution in cyberspace takes weeks or months. Investigators compare tactics, techniques, and procedures (TTPs)—"kind of like their trademark fingerprints"—against known threat actors.
What Small Businesses Should Do Now
You cannot control whether critical infrastructure gets attacked. But you can reduce your vulnerability to supply chain disruption and protect any operational technology your business depends on.
For Supply Chain Risk:
- Map your critical suppliers. Which vendors provide essential materials, services, or shipping? If they were disrupted for 7 days, 30 days, or 90 days, what would happen to your business?
- Identify alternative suppliers or workarounds. Can you source from multiple vendors? Can you keep strategic inventory? Can you pivot to manual processes if critical systems go down?
- Communicate with suppliers about their cybersecurity. Ask critical vendors about their security practices, backup plans, and incident response procedures. If they have no plan, that's a risk.
- Build financial buffers. Supply chain disruptions are expensive. The organizations that survive them have cash reserves, insurance, and contingency plans.
If You Operate Machinery or Operational Technology:
- Segment your network. Do not put operational technology on the same network as your business IT systems. Use separate networks, firewalls, and access controls. This is the single most important control.
- Limit internet connectivity for critical machinery. If a machine doesn't need to be internet-connected, don't connect it. If it must be connected, use strong authentication, encrypted communications, and monitoring.
- Implement strong authentication. Default passwords are the easiest entry point. Change them. Use multi-factor authentication where possible.
- Monitor for unauthorized changes. Set up alerts for changes to critical systems—firmware updates, configuration changes, unexpected access patterns.
- Test your recovery procedures. If a critical system is compromised, can you restore it to safe operation? How long does recovery take? Practice this before you need it.
Organizational Preparedness:
- Document your critical systems and dependencies. Know which systems are essential to operations and which systems depend on critical infrastructure.
- Create a supply chain incident response plan. If a key supplier, port, or energy facility is compromised, what's your response? Who makes decisions? How do you communicate with customers?
- Consider cybersecurity as a supply chain risk. This is not a "nice to have"—it's a business continuity issue.
Critical Infrastructure and Cyber Insurance
If your organization operates critical infrastructure or depends heavily on it, review your cyber insurance policy. Policies often include business interruption coverage, which may compensate you for losses from supply chain disruptions caused by cyberattacks.
However, coverage varies widely. Some policies exclude specific industries or require evidence of your own security controls before covering supply chain losses. Understand your coverage before an incident occurs.
The Bigger Picture
The tanker attack is not an isolated incident. It's one of 40-50 similar operations the Coast Guard's cyber teams have conducted this year. It reflects a broader reality: critical infrastructure—maritime, energy, water, transportation—is increasingly under attack from nation-states and sophisticated cyber criminals.
Small businesses are not the direct targets. But they are downstream casualties of these attacks. Supply chains break. Shipping delays ripple across industries. Costs rise. Operations pause. The economic damage spreads.
Grable's warning to the maritime industry applies to all small businesses: "We need everybody to pay attention to this."
What to Do Now
- This week: Map your top 10 suppliers and their geographic locations. Identify which are irreplaceable and which have alternatives.
- This week: If your business operates machinery or has operational technology, audit network connectivity—which systems are internet-facing? Can they be isolated?
- Next week: Contact your 3 most critical suppliers and ask about their cybersecurity practices and backup plans. Their response will tell you how serious they take this.
- Next 30 days: Develop a supply chain disruption response plan. What happens if a key supplier is offline for 7 days? 30 days? Document the impact and your contingency options.
- Next 30 days: Review your cyber insurance to confirm it covers supply chain losses and business interruption caused by cyberattacks.