US authorities are investigating whether Iran orchestrated cyber attacks on two tankers that were sailing toward American ports, according to officials familiar with the matter. The vessels were targeted as they transited the Strait of Gibraltar, raising concerns that Tehran may be exploring fresh tactics to broaden the scope of conflict in the Middle East.

Based on vessel tracking data and statements from one official, the two ships — a crude oil tanker and a liquefied petroleum gas carrier — came under attack in early August while navigating the strait, with both ultimately bound for ports in Texas. The location of the incident and the ships' destinations have fueled speculation that Iran or its affiliated proxies may be seeking to disrupt another vital maritime chokepoint, or even trigger explosions at American harbor facilities.

Modern vessels depend heavily on integrated systems; if these are compromised, the consequences could include detonations, collisions, or oil spills. After the two tankers entered the Gulf of Mexico in August, a specialized team led by the US Coast Guard and involving FBI agents boarded both ships, officials said.

Rear Admiral Amy Graybeal, commander of the Coast Guard's Cyber Command, declined to identify the specific ships involved. However, she noted that Coast Guard cyber response teams spent three to four days aboard each vessel conducting incident response, eliminating system vulnerabilities and ensuring the ships could proceed safely.

"Regrettably, on many ships, IT systems are interconnected with other onboard systems — those that control power generation, propulsion, and navigation equipment," Graybeal said. "If these systems are breached or manipulated, the crew could lose command and control of the vessel, potentially leading to accidents or collisions. That is precisely the risk we are focused on mitigating."

According to Lloyd's List Intelligence vessel tracking data and a US official, one of the targeted tankers, the VL Prosperity, was carrying over 2 million barrels of crude oil from Egypt to Galveston, Texas, when it was attacked in the Strait of Gibraltar. Tracking data shows that as the ship approached the US coast, a Coast Guard vessel pulled alongside and boarded it.

The semi-official Iranian news agency Mehr reported on the incident in August. The outlet cited crew members as saying the attackers infiltrated the VL Prosperity's engine room systems, reducing engine cooling flow, increasing engine rpm, and disabling the ship's fuel and lube oil tanks. According to the report, no group has claimed responsibility for the attack.

The second vessel, the Kohaku, was transiting the Strait of Gibraltar en route to another Texas port to load liquefied petroleum gas, according to vessel tracking data and US officials. Data indicates that the same Coast Guard vessel that had previously boarded the VL Prosperity also conducted a boarding operation on the Kohaku.

The managers of the VL Prosperity confirmed that US authorities boarded the vessel for a cybersecurity inspection and that the ship has since been cleared to resume normal operations. The managers of the Kohaku did not respond to requests for comment.

The Coast Guard and FBI have declined to disclose how many cyber attacks on ships have been investigated since the conflict with Iran began. A Coast Guard spokesperson stated that there have been no reports of vessel instability or threats to crew safety, and that the service is actively coordinating with port operators, ship owners, and local maritime stakeholders to ensure the security of port operations.

The US and Iran have long been locked in a standoff in the Strait of Hormuz, a strategic waterway along Iran's coast that carries a significant share of the world's oil shipments. Iran has attacked commercial vessels that transit without permission or payment of fees, drawing retaliatory actions from Washington. Meanwhile, the Iran-backed Houthi movement effectively controls the Bab el-Mandeb Strait at the entrance to the Red Sea.

Iran and its proxies have sought to choke off petroleum shipments as a means of applying pressure on the United States and its Persian Gulf allies. Like these other maritime chokepoints, the Strait of Gibraltar is critically important to global energy markets. Roughly 300 ships transit this passage connecting the Mediterranean Sea and the Atlantic Ocean every day.

Experts have warned that cyber attacks against ships carry extreme dangers, with the level of risk depending on the sophistication of the attack and the type of vessel involved. The Coast Guard maintains dedicated teams responsible for responding to and investigating such cyber intrusions. Earlier this year, these teams boarded several sanctioned "shadow fleet" tankers seized by the US to inspect their onboard systems for tampering, preventing potential safety incidents once the vessels reached American or other ports.

During a June interview, Coast Guard Cyber Command head Rear Admiral Jason Doyoe said: "A vessel carrying millions of gallons of highly volatile crude oil always carries the risk of fire and explosion. The environmental conditions within its cargo tanks must be managed with extreme precision to prevent ignition, and the risk of an oil spill is ever-present."