In August and September 2026, three commercial tankers were hit by suspected cyber incidents within roughly a month of each other. The attacks did not target customer data or financial systems. They targeted the software and hardware that physically run vessels at sea: the systems controlling engines, cargo, and navigation.
For Singapore businesses in shipping, freight, and offshore operations, the pattern raises a practical question: does your insurance programme actually cover this?
In brief
- On 21 August 2026, US Coast Guard and FBI teams boarded the crude tanker VL Prosperity after finding signs of malicious cyber activity on its network. A similar boarding followed for the LPG carrier Kohaku three days later.
- In early September, the crew of the LNG tanker Vivit Africa lost access to onboard systems that monitor cargo. The vessel diverted without unloading.
- All three incidents involved what the industry calls operational technology (OT) — the systems that control physical processes on a vessel, as distinct from the computers used for administration or communication.
- Following the August incidents, US authorities were reported to be monitoring nearly 20 ships worldwide for potential cyber threats.
- Standard marine cargo and hull policies do not typically cover cyber incidents. This creates a gap that is worth understanding before a claim arises.
What happened on each vessel?
VL Prosperity and Kohaku (August 2026)
On 21 August 2026, a team from the US Coast Guard and FBI boarded the VL Prosperity, a crude oil tanker carrying approximately 2.3 million barrels from Egypt to Galveston, Texas. The team found evidence of malicious cyber activity on the vessel's network and spent four days aboard investigating. The Coast Guard later confirmed the incident as malicious. No physical damage or injuries were reported at that time.
Three days later, a similar boarding took place on the Kohaku, an LPG carrier also bound for Texas. Authorities found no operational disruption, vessel instability, danger to crew, or environmental impact. No group claimed responsibility for either attack.
Vivit Africa LNG (September 2026)
In early September, the crew of the Vivit Africa, an LNG tanker on long-term charter to Vitol, reported losing access to internal systems while sailing from Louisiana to Italy. The Italian Coast Guard described a malfunction in the systems used to monitor cargo parameters, which required the vessel operator's technicians to fix. The ship left on 16 September without unloading and was later tracked near Tunisia.
Kongsberg Maritime, which supplied navigation and propulsion equipment for the vessel, acknowledged the reports but said it was too early to draw conclusions about the cause. The Korean Register opened an investigation. Whether the incident was a cyberattack, an equipment fault, or a combination of the two has not been established. (Sources: The Digital Ship, gCaptain, Hellenic Shipping News, Insurance Journal, September to October 2026.)
What is operational technology, and why does it matter?
Operational technology (OT) is any hardware or software that controls physical equipment. On a ship, this includes the engine management system, power controls, cargo loading computers, remote valve controls, ballast systems, navigation equipment, and emissions monitoring. These are the systems that physically run the vessel.
Historically, OT systems ran in isolation with no connection to the outside world. Today, they are increasingly connected to the internet for remote monitoring, fleet management, and maintenance. That connectivity brings operational benefits and introduces a new way for attackers to get in.
When an OT system on a vessel fails, whether from a cyberattack or any other cause, the commercial consequences are immediate and concrete. The Vivit Africa diverted without unloading not because anyone was in danger, but because the crew could not safely operate the cargo systems without access to their monitoring data. The lost time and cargo delay happened regardless of the root cause.
Dragos, an industrial cybersecurity firm that published analysis of the VL Prosperity incident, noted that attackers most commonly reach OT systems through weaknesses in connected administrative IT systems, not by targeting OT directly. The separation between a vessel's administrative and operational systems is often less complete in practice than it appears on paper. (Source: Dragos, October 2026.)
Which Singapore businesses face this risk?
Any business that owns, operates, charters, or relies on vessels with networked onboard systems is exposed. The level of risk depends on what those systems control, how old the equipment is, and how it is connected.
Shipowners and ship managers. Both the VL Prosperity and the Vivit Africa were managed by third parties, not their owners. This raises a practical question about where responsibility for onboard cyber security sits between owner, manager, and charterer — and which party's insurance responds.
Freight forwarders and cargo owners. If a vessel is diverted or unable to unload because of a cyber-related system failure, the cargo on board may be delayed or damaged. A standard marine cargo policy is not designed to respond to this scenario.
Marine logistics and port operations. In 2022, a ransomware attack on Oiltanking and Mabanaft disrupted automated tank loading at major German fuel terminals, demonstrating that the same category of risk applies to shore-based logistics operations that rely on automated OT systems.
Offshore and energy operations. Vessels and platforms involved in oil, gas, and offshore energy face the same exposure, and the consequences of a system failure in those environments can extend well beyond commercial disruption.
Does cyber insurance cover a marine OT incident?
Marine cargo and hull insurance policies are built around physical perils: collision, grounding, storm, fire. Most include explicit cyber exclusions, meaning that a cyber incident that causes a vessel to divert or lose access to its systems would not be covered under those policies alone.
Cyber insurance is designed to respond to losses arising from a cyber incident. In a maritime OT scenario, a cyber policy may respond to business interruption losses during the period of disruption, the costs of investigating and restoring systems, and third-party liability where the incident affects cargo owners or other parties. Whether physical loss, such as damaged or unsalvageable cargo, is covered depends on the specific policy wording.
The Vivit Africa incident illustrates a related complication: if the cause of the loss is disputed, whether it was a cyberattack or an equipment failure, insurers across multiple policies may each argue the other is responsible. That question can take time to resolve, during which the business bears the loss.
The practical question is whether your combined insurance programme, marine, property, and cyber together, covers the scenario in which a vessel's onboard systems are compromised. The answer is often that coverage is partial or ambiguous, and that the gap only becomes visible when a claim is made.
The practical question
Three vessels affected in a single month is a pattern, not a coincidence. Whether the incidents were connected or separate, they confirm that shipboard OT systems have become a target.
For Singapore businesses involved in shipping, offshore operations, marine logistics, or the movement of cargo, the relevant questions are: which systems on the vessels you own, manage, or charter are connected to the internet; who is responsible for keeping those systems secure; and whether your insurance programme responds if they are compromised.
If the answers are uncertain, they are worth establishing before an incident rather than after.
This article provides general information only. It is not insurance advice. Policy availability, terms, conditions, and exclusions vary by insurer and product, and cover is subject to the full policy wording. Please contact TZY CO for advice on your specific situation.