Three tankers have been linked to suspected cyber incidents within roughly a month, exposing the difficulty shipowners face when a failure in a connected onboard system could be either a technical fault or a cyber event. The latest case, H-Line Shipping’s Vivit Africa LNG, is particularly notable because the vessel was carrying US LNG to Italy before turning away from its destination.
The incidents began with two US-bound tankers in August.
The first, VL Prosperity, a Liberian-flagged crude tanker managed by HMM Ocean Service, was boarded by US Coast Guard and FBI cyber teams on 21 August after authorities found indications that its network had been compromised. The second, Kohaku, an LPG carrier, was boarded three days later under similar circumstances. US authorities said there were no reports of operational disruption, vessel instability, physical danger to crews or environmental impact.
The Coast Guard later confirmed malicious cyber activity aboard VL Prosperity. Authorities have not publicly attributed either incident to a specific actor.
The third case involves the Vivit Africa LNG, owned by South Korea’s H-Line Shipping and on long-term time charter to Vitol.
The LNG carrier was sailing from Louisiana towards the Adriatic LNG terminal near Rovigo, Italy, when its crew reportedly lost access to some internal control systems in early September. The crew reported the incident to Korean Register, which is investigating.
The Italian Coast Guard gave a more cautious account. Captain Roberto D’Arrigo said the master reported “a malfunction in the systems used to monitor cargo parameters, requiring intervention by the company’s technicians.” He added that “the Chioggia Coast Guard intervened solely for navigation safety purposes, issuing an urgent notice to mariners to keep their distance.”
The cause has not been established. The vessel remained off Italy without unloading its cargo before leaving the area on 16 September and heading towards Algeciras. It was later tracked near Tunisia.
Kongsberg Maritime, which supplied some of the vessel’s positioning, navigation and propulsion equipment, said it was aware of the reports. Spokesperson Jon Berge said it was “too early to draw conclusions regarding the cause or any potential security implications.”
That distinction matters for shipowners and managers. The three cases involve different circumstances, systems and levels of confirmed evidence, yet all raise the same operational problem: when a critical shipboard system fails, can the operator quickly establish whether it is an equipment malfunction or a cyber incident?
The answer affects how crews isolate systems, protect operational technology, preserve forensic evidence and coordinate with shoreside teams and authorities.
The Vivit Africa LNG case adds another layer. A cyber incident does not have to take control of a vessel to create operational consequences. Losing access to cargo-monitoring or other critical systems can be enough to interrupt a voyage while the operator determines what has happened.
With US authorities now monitoring nearly 20 ships worldwide for potential cyber threats, the three tanker cases have turned a cybersecurity concern into a fleet-management issue.
