Hackers breached the propulsion system of a US-bound oil tanker

(Bloomberg) — FBI and U.S. Coast Guard investigators have found evidence that hackers gained access to the propulsion system of an oil supertanker approaching the Texas coast this summer, an extraordinary breach that underscores the growing physical risks of cyberattacks, according to U.S. officials familiar with the matter.

The cyberattack resulted in foreigners gaining temporary access to the ship’s digital system, said the people, who asked not to be identified because they were not authorized to discuss the matter. Officials are still investigating how the breach occurred and who was responsible. It was not immediately clear how long the hackers had access or what they were able to do with it aboard the ship.

The disruption of the tanker’s propulsion system, a rare and particularly invasive hack into the ship’s operations, underscores the urgency that led US authorities to board the VL Prosperity in August. Longer than the Chrysler Building, tall and as wide as a football field, the ship was fully loaded and bound for Galveston.

The Coast Guard declined to comment. The FBI declined to answer questions beyond providing a statement the two agencies previously released about their joint boarding of the VL Prosperity and another ship “to ensure the integrity of the vessel’s operational and information technology systems following an indication that both vessels’ networks had been compromised.”

“There are currently no reports of operational malfunctions, vessel instability, physical hazards to crews, or environmental impacts,” the FBI said in an emailed statement.

The prospect of unknown hackers being able to remotely control the operating system of such a tanker, known as the Very Large Crude Carrier, has alarmed US military and intelligence officials. It highlights warnings of cyber-attacks targeting the maritime sector, which have escalated in recent years as shipping vessels become increasingly dependent on networked systems for navigation, communications and other operations.

Alex Soukhanov, whose firm True North Group works on maritime cyber security, said confirmed hacking of ship systems is rare but can have a huge impact.

“They are the largest moving objects in the world that transport the world’s economy,” said Soukhanov, who is a licensed ship captain. “We simply cannot have this type of unauthorized access. Every sailor should be extremely concerned.”

In late August, a joint team of Coast Guard and FBI personnel boarded the VL Prosperity after it lost communications and authorities received indications that its network had been compromised by hackers, Bloomberg News reported. That month, agencies also boarded another vessel in the Gulf of Mexico over a suspected cyber threat.

By September, U.S. government agencies were monitoring cyber threats against nearly 20 vessels around the world, and the Coast Guard had requested advance notice if any of those ships planned to enter a U.S. port, Bloomberg previously reported.

It would be a “worst-case scenario” for a large ship carrying hazardous material to lose some of its functions in a cyber attack, said Svante Einarsson, head of cyber security at ship engineering consultancy DNV. But, Einarsson added, most vessels have the ability to rely on other systems that allow crews to continue operations.

The Prosperity remains docked off the coast of Galveston, according to shipping data compiled by Bloomberg.

–With help from Myles Miller and Lucia Kassai.

More such stories are available at bloomberg.com