A crude oil tanker bound for Galveston. On 21 August 2026 a US Coast Guard team boards: law enforcement personnel, a vessel inspector and a cyber protection team. The FBI's cyber action team is with them. The public statement does not specify how long the examination lasted.
The team examined the ship’s information systems as well as its operational technology systems. In other words, they looked at a tanker the way they would look at a refinery ashore. CBS News, September 2026
Let’s examine the ship’s control systems, the access and maintenance difficulties at sea, and what can be verified about this incident.
On a modern merchant ship the bridge, the engine room and the cargo systems are run by computers. The bridge has the electronic chart system (ECDIS), radar, the automatic identification system (AIS) and navigation instruments. The engine room has the engine control and alarm system that controls the main engine, the generators and the auxiliary systems. On a tanker, cargo tank levels and ballast water are managed from a separate control system. Inside these systems run the same kinds of PLCs and controllers as in factories ashore. The link between ship and shore is satellite communication (VSAT); the same antenna serves both the company office and the crew's internet.
What is OT on a ship?
Even on a small sailing boat we see the same logic: the autopilot holds the helm, the engine has its own electronic control, and the instruments send position and wind data to each other over a network called NMEA. On a large ship the same idea grows hundreds of times over, and every system is installed by a different supplier.
Enlarge details
The systems in the diagram look independent of each other; in practice they are tied together. The alarm system in the engine room sends data to the bridge. When there is a fault, the supplier wants to connect remotely to its own system over the satellite. A crew member plugs a file downloaded in port into the engine room computer with a USB stick. Each of these crossing points is what we call "the place where IT meets OT" in a factory ashore.
The International Maritime Organization (IMO) made this official in 2017. Resolution MSC.428(98) asks for cyber risks to be included in a ship's safety management system; companies had to do this by the first annual verification of their Document of Compliance after 1 January 2021. The current version of the IMO's cyber risk management guidelines is MSC-FAL.1/Circ.3/Rev.4. IMO, Maritime cyber risk
Why is it harder than a plant ashore?
At a refinery the security team is on site; a network cable can be pulled, a device can be swapped, an expert can be called. None of that is easy on a ship.
- The ship is moving. At the moment of the incident, the nearest expert is thousands of miles away. In the tanker case, the team boarded a Texas-bound ship; the reporting does not show that boarding was only possible after it reached the coast.
- There is one link. The satellite link carries the company e-mail, the supplier's remote maintenance and the crew's phones. Bandwidth is growing with new low-orbit satellites, but continuous security monitoring from shore still does not exist on most ships.
- The crew rotates. The electrical officer on board knows the control systems, but cyber security is not their main job, and in a few months they move to another ship.
- Many suppliers, one owner. The bridge system comes from one company, the engine control from another, the cargo system from a third. Each wants its own remote access path.
- The systems are old. A ship serves for twenty-five years. The operating system on the bridge computer may be a version whose support ended long ago ashore.
According to a survey Honeywell published in September 2026, 73 percent of OT leaders say they had a significant OT incident in the last twelve months; in maritime that figure is 87 percent. This is a survey, not a measurement; the figures are self-reported. Still, maritime coming out on top across sectors fits the difficulties above. Honeywell, 2026 OT Cybersecurity Benchmark Report
A read in the engine room
Shipboard control systems use the same protocols as their counterparts ashore. Let's examine a Modbus/TCP read request and response decoded with TShark.
The monitoring system tells the controller "give me two values from register 100," and the controller answers:
Modbus/TCP Query: Unit: 1, Func: 3: Read Holding Registers
Reference Number: 100
Word Count: 2
Modbus/TCP Response: Unit: 1, Func: 3: Read Holding Registers
Byte Count: 4
Register 100 (UINT16): 750
Register 101 (UINT16): 320
Enlarge details
This is an ordinary read; it could be a speed, a temperature or a tank level. But notice: there is no authentication in the packet. Whether a client that reaches the Modbus service can read or write depends on the device implementation and network access controls; classic Modbus/TCP does not itself authenticate a user. Ashore we separate the control network for exactly this reason; the same holds on a ship. Without effective separation between crew devices and the controller, this access can be exposed to unauthorized use. A shared physical switch can also carry networks separated by VLANs and access rules. The question in the next section, "is the crew network on the same network as the control systems?", asks precisely this.
This example was also built with scapy and decoded from file with TShark 4.2.2.
What do we know about the incident, and what do we not?
The reporting on this incident is mixed; some is official statement, some anonymous sourcing, some partisan media. It has to be separated.
| Information | Source | Status |
|---|---|---|
| Coast Guard and FBI teams boarded the ship on 21 August; IT and OT systems were examined. | Coast Guard statement, via CBS | Verified |
| There were indications that the ship's network may have been compromised by a foreign actor. | Joint Coast Guard and FBI statement | Verified |
| "No reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts." | Coast Guard statement | Verified |
| A second vessel was boarded in the Gulf of Mexico the same month; by September, cyber threats against nearly twenty vessels worldwide were being tracked. | Bloomberg, unnamed US officials | Single source, anonymous |
| The attackers gained temporary access to the ship's propulsion system. | Bloomberg, 5 October 2026, unnamed officials | Not officially confirmed |
| The attackers changed engine cooling, speed, fuel and lubrication systems; the ship was without communications for thirty hours. | Iranian state media, unnamed crew member | Unverified claim |
| How access was gained, how long it lasted and who did it. | Not determined by officials | Open |
CBS News · Insurance Journal / Bloomberg, 5 October 2026
The most important thing in this table is that "no reports of operational disruption" and "access to the propulsion system" sit side by side. Both can be true at once: reaching a system and breaking it are not the same thing. We draw the same line in the PLC articles ashore. Access to a device is one thing; permission to operate on the device is another; actually affecting the process is a third. On a ship, the last rung of that ladder is cut by an engineer who can switch to local control in the engine room; but only if the interference is noticed. If the alarm and monitoring screens have been tampered with too, the crew cannot tell when to switch. That is why ships keep the "manual control" capability, and why it only helps while the monitoring system stays trustworthy.
Officials have not said who carried out the attack. The incident first reached the public through Iranian media; CBS's account confirms that order. In that situation, saying "Iran did it" would mean putting a claim in the place of evidence.
The rules changed for new ships
From 2024, things changed a little for newly built ships. IACS, the association of classification societies, published two unified requirements: UR E26 covers the cyber resilience of the ship as a whole, and UR E27 covers the resilience of on-board systems and equipment. These apply to new ships contracted for construction on or after 1 July 2024. IACS, UR E26 and E27 press release
The documents E26 asks for are familiar from OT projects ashore: the system integrator provides a zones and conduits diagram, a vessel asset inventory and a cyber security design description; the shipowner provides the operational programme. Dividing a ship's network into "zones" and defining the passages between them is now part of the design stage.
But the IACS rules are for new ships. Most of the world fleet was built before 2024; on those ships the IACS requirements remain guidance, while the IMO safety management framework also addresses cyber risk on existing ships covered by the ISM Code. We do not know which group the tanker off Texas falls into; but the incident is a reminder of how large the fleet outside the rule is.
What do we look at on board?
When we go on board, the questions we ask at a plant ashore still apply, with a few ship-specific additions.
| Question | Why it matters |
|---|---|
| Which supplier can connect to which system over the satellite, and when? | Remote maintenance access is the ship's widest door; usually nobody keeps the list. |
| Is the crew network on the same network as the control systems? | If phones and laptops can reach control services, separation is insufficient; sharing a physical switch alone does not prove this. |
| Are USB sticks plugged into bridge and engine computers, and who controls that? | Charts and updates arriving by USB is normal on a ship; without a policy it is an open door. |
| How many minutes does it take to switch to local control in the engine room, and who knows how? | When the digital system becomes untrustworthy, this capability is what keeps the ship moving. |
| Are system backups and installation media on board? | Support from shore can take days; the ship must be able to get back on its feet by itself. |
This table is the practical counterpart of the IMO guidelines and the IACS requirements; it was not derived from the incident itself. The little we know about the incident itself does not change this list; it raises its importance.
Our question
Looking at a tanker and asking "was this ship cyberattacked?" gets us nowhere, because even the officials have not fully answered that yet. The better question is this:
Who can connect to this ship's engine room over the satellite, and when the link goes down, can the ship be run by hand?