VL Prosperity: What MTSA Cybersecurity Already Requires
Summary: On August 21, 2026, U.S. Coast Guard law enforcement, a USCG Cyber Protection Team, a vessel inspector and an FBI Cyber Action Team boarded the 333-meter crude oil tanker VL Prosperity in the Atlantic after its network showed signs of compromise by a foreign cyber actor, and a second 227-meter LPG tanker, The Kohaku, was boarded three days later in the Gulf of Mexico after a suspected related attack. USCG and FBI found malicious cyber activity and performed incident response with no physical damage, environmental impacts or crew injuries reported at the time, while claims that the attacker reached propulsion, navigation and cargo systems come only from Iranian state media and have not been independently corroborated by Dragos.
Key Takeaway: MTSA cyber rules have been in force since July 16, 2025, yet the July 16, 2027 deadline for a designated Cybersecurity Officer, a completed Cybersecurity Assessment and an approved Cybersecurity Plan still leaves most of the industry with real work to do. The systems named in the unconfirmed claims about VL Prosperity - engine cooling, fuel and lube-oil - are the same category that failed at Freeport LNG in 2022, and the consequence looks identical whether the root cause is a misconfigured procedure or a manipulated system.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026