The VL Prosperity cyberattack investigation is part of a broader U.S. federal inquiry involving two U.S.-bound commercial vessels whose networks showed indications of compromise. Current Coast Guard and FBI statements carried by multiple major news organizations confirm federal boardings and cyber investigations, but they do not establish who carried out the intrusions or prove that propulsion, navigation or cargo-control systems were taken over.
Direct answer: U.S. authorities have confirmed investigations involving two vessels after signs that their computer networks were compromised. The Coast Guard said foreign cyber actors were involved in the August 21 case but did not identify them. Reporting and the vessel manager identify one investigated tanker as VL Prosperity. Claims that Iran was responsible or that hackers definitively controlled propulsion or engine-room systems remain unconfirmed in the evidence reviewed by TPS.
What U.S. authorities have confirmed
The FBI said joint federal teams boarded commercial vessels on August 21 and August 24 after receiving indications that their networks had been compromised. Reporting on the operation says Coast Guard law-enforcement personnel, Coast Guard cyber specialists and FBI cyber personnel were involved.
The Coast Guard separately said that the vessel investigated on August 21 showed indications of compromise involving foreign cyber actors. That phrase establishes a foreign cyber-actor dimension to the Coast Guard’s account, but it does not identify a country, government, criminal group or named threat actor.
Was VL Prosperity one of the investigated vessels?
Current reporting and confirmation attributed to the ship’s manager identify VL Prosperity, a crude tanker, as the vessel involved in the August 21 investigation. The Coast Guard statement reviewed through current reporting did not itself publicly name the ship, so TPS is preserving that distinction rather than presenting the vessel name as if it came directly from the agency statement.
What remains unconfirmed about the cyberattack
The most consequential uncertainty is the difference between a confirmed network compromise and claims about exactly which onboard systems were affected. U.S. agency statements reviewed by TPS do not establish that attackers successfully controlled propulsion, navigation, cargo handling or other operational-technology functions.
Some reporting traces more dramatic technical claims to Iranian media, including allegations about interference with engine-room or propulsion-related systems. Those claims should not be treated as equivalent to Coast Guard or FBI confirmation.
Has Iran been identified as the attacker?
No public attribution reviewed by TPS establishes Iran as the responsible actor. The Coast Guard’s wording refers to foreign cyber actors without naming them. That means the current evidence supports foreign involvement in the August 21 case, but not a specific national or state attribution.
Readers should also distinguish a foreign cyber actor from a foreign government. Those are not interchangeable claims, and the current evidence does not justify collapsing them into one conclusion.
Was the tanker disabled or made unsafe?
For the August 21 investigation, the Coast Guard said there were no current reports of operational disruption, vessel instability, danger to the crew or environmental impact. That limits how far the event can currently be described as an operational maritime crisis.
The investigation is still significant because vessel networks can connect conventional information technology with operational systems used aboard commercial ships. Federal cyber teams examining both information and operational technology indicates that authorities treated system integrity seriously, but examination of those systems does not by itself prove they were successfully manipulated.
Why this matters for shipping and energy logistics
Commercial tankers are part of tightly connected maritime, port and energy-logistics systems. A confirmed compromise of onboard networks can require incident response, forensic examination, communications with port and federal authorities, and decisions about whether a vessel can continue operating safely.
However, TPS found no basis to claim that this incident disrupted U.S. crude flows, port operations or the broader energy supply chain. Those are plausible exposure paths, not demonstrated consequences of the two investigations.
Confirmed, reported and unverified claims
Confirmed through direct agency statements carried by reputable reporting: two federal vessel investigations; indications that vessel networks were compromised; Coast Guard involvement with FBI cyber personnel; foreign cyber actors referenced in the August 21 case.
Corroborated through reporting and vessel-management confirmation: identification of VL Prosperity as one investigated tanker.
Still unverified: Iranian responsibility, a confirmed nation-state attribution, the precise intrusion method, the exact compromised IT or operational-technology systems, and detailed claims that attackers manipulated propulsion or engine-room controls.
What TPS verified
TPS compared current Reuters, ABC News, CBS News, Bloomberg, Recorded Future News, Cybersecurity Dive and SecurityWeek reporting to separate direct Coast Guard and FBI statements from secondary vessel identification and more speculative technical or attribution claims. A directly hosted Coast Guard or FBI incident page containing the full public record was not recovered during this review.
What could change next
The current answer could change materially if the Coast Guard, FBI, CISA or another federal authority publishes a direct incident artifact, identifies the second vessel, attributes the activity to a named actor, discloses which IT or operational systems were compromised, or explains the intrusion and remediation path. Those developments should update this same canonical article rather than create a new URL for the same investigation.