A crude oil tanker bound for the US suffered a reported cyber incident while transiting the Strait of Gibraltar in early August 2026.
A US multi-agency cyber team boarded the vessel in the Gulf of Mexico on August 21 to assess its IT and operational technology systems. A second tanker was boarded on August 24 following another reported compromise.
Public reporting indicated the first vessel lost communications for approximately 30 hours and that engine-room systems may have been manipulated. Malicious cyber activity was reportedly identified, though the vessel remained safe to navigate. Technical detail remains limited and neither the full operational impact nor attribution has been independently verified.
Cyber incidents affecting vessels directly, rather than ports or administrative networks, are still rarely reported. Most documented maritime cyber events, including the NotPetya attack that cost Maersk an estimated $300 million in 2017, affected shore-based systems rather than a vessel's own operational technology. Reported activity reaching engine-room systems represents a qualitatively different category of risk.
The US Coast Guard's Cyber Protection Team reportedly undertook 40 to 50 missions over the past year, and US agencies are reported to be tracking cyber activity affecting nearly 20 vessels globally.
Harriet Gruen (pictured, left), head of cyber threat intelligence at Howden Re, said the market should be careful not to overstate what is known.
"The important point is not to overstate what we know about this individual incident. Technical detail remains limited and some of the reported effects have not been verified. What is notable is that the alleged activity reached beyond administrative IT to the vessel itself. As ships become more connected, and reporting requirements improve, we should expect greater visibility of cyber activity affecting maritime operations," Gruen said.
Richard Miller (pictured, right), managing director of global specialty treaty at Howden Re, said the incidents illustrate a wider structural concern.
"Marine risk has always reflected the interaction between technology, trade and geopolitics. Greater connectivity adds another layer: a cyber event affecting a vessel's operational systems has the potential to move quickly from a digital issue to a physical and commercial one. Even where the immediate insured impact is limited, understanding those dependencies will become increasingly important for insurers and reinsurers," Miller said.
New US Coast Guard cybersecurity requirements introduced in 2025 and being phased in through 2027 will impose mandatory incident reporting and cyber risk management standards on vessels calling at US ports for the first time. Howden Re said those requirements should surface incidents that would previously have gone unreported, meaning the current picture of maritime cyber frequency is likely an undercount.
For marine underwriters, the immediate coverage question centers on how marine hull, P&I, cargo and standalone cyber policies interact when a single vessel incident potentially triggers all four. A cyber event affecting engine-room OT could simultaneously generate property damage claims under hull, third-party liability under P&I, delay or damage claims under cargo, and a cyber claim if a standalone policy is in place.
Whether those coverages respond consistently, or whether attribution and policy wording disputes create gaps, is a question these incidents bring into sharper focus.
