Security1 publisher2 min readPublished
Hackers briefly held pressure and safety valve controls on the tanker Vivit Africa LNG, trade press reports
Federal agencies are watching nearly 20 ships after hackers reportedly took temporary control of safety valves on the tanker Vivit Africa LNG. The FBI and Coast Guard have boarded suspect ships in the Gulf, though the valve account still rests on trade-press reports.
The Watch · Security desk
What happened
- The Liberian-flagged LNG tanker Vivit Africa LNG idled off Italy for several days after a sudden system malfunction on its voyage to Europe.
- Shipping trade outlets report that hackers gained temporary control of the tanker's steam pressure and safety valve systems while it transited the Strait of Gibraltar.
- The tanker then turned west toward Algeciras, Spain, without delivering its cargo to the Italian buyer, according to Bloomberg.
- The FBI and Coast Guard confirmed boarding two inbound foreign-flagged ships in the Gulf of America after signs that both ships' computer networks were compromised.
- Federal intelligence agencies are monitoring nearly 20 commercial vessels worldwide following the attack on the tanker.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure If the trade accounts hold, intruders reached the automated controls that manage cargo tank pressure on a loaded LNG carrier. That is a physical safety exposure for the ship and crew.
- precedent An operator whose ship shows signs of network compromise on approach to a US Gulf port should now expect the FBI and Coast Guard to board it and check its operational systems.
- contradiction One trade account places the intrusion at Gibraltar and another near Rovigo, so it is unclear whether the tanker was hit once or stayed compromised for the rest of the voyage.
The only words from a US agency on the record come from the boarding statement. The FBI and Coast Guard said they went aboard to "ensure integrity of the vessel's operational and information technology systems" [5]. The Center Square reported on September 22 that the agencies had confirmed the Gulf boardings the week before [10]. Vivit Africa LNG was stalled off Italy and was not one of those ships [3][5].
Everything known about the tanker's control systems comes from shipping trade press, relayed by The Center Square. The Gibraltar account comes from The Maritime Executive and Safety4Sea [6]. Marine Insight placed the intrusion later, as the ship neared its destination of Rovigo, Italy. In its version the attack compromised the automated tank pressure controls and disrupted the boil-off gas management cycle, and could have caused catastrophic failures [7].
Read together, the reports put attackers in the automated cargo tank controls of a loaded LNG carrier. They also put them there at two different points on the voyage [6][7]. According to Bloomberg, which first reported the incident, the 299-meter ship loaded at Cameron LNG's terminal in Louisiana in late August [2].
A second Liberian-flagged tanker matches part of that pattern. VL Prosperity, a crude oil supertanker, passed through the Strait of Gibraltar in early August. Its crew then had a 30-hour communications blackout and an engine-room systems malfunction [9]. Federal agents boarded it near Galveston, Texas, in late August [8]. The two ships share a flag and a Gibraltar transit before their systems failed [12]. The reporting does not identify an attacker or an entry point for either ship.
Counting Vivit Africa LNG and the two Gulf ships, at least three vessels are reported or suspected to have been compromised [11]. The report calls VL Prosperity "another" vessel, so it may be a fourth [8].
What to watch
- Confirmation or denial of the tank pressure and safety valve access from the owner or operator of Vivit Africa LNG, or from a US agency.
- Whether the monitoring of nearly 20 vessels turns into further FBI and Coast Guard boardings at US Gulf ports.
- Any public attribution or entry point that ties Vivit Africa LNG and VL Prosperity to the same actor.