Hacked Tanker Exposes a Gap: US Maritime Cyber Rule Excludes Foreign-Flagged Ships
A supertanker carrying more than 2 million barrels was reportedly breached on its way to Texas, and the Coast Guard's own cyber rule excludes ships like it. The gap is deliberate, so the pressure on owners will come from insurers and charterers, not Washington.
A very large crude carrier, able to hold more than 2 million barrels, was bound for Texas this summer when, officials say, hackers got into its systems. Most of the discussion since has been about who did it. No US cybersecurity rule applied to that ship, a more useful distinction than the debate over attribution.
The exclusion is deliberate. The Coast Guard's 2025 cyber rule for the marine transportation system covers US-flagged vessels and regulated US facilities, and the tanker is Liberian-flagged. The United States can board and inspect such a ship but has chosen to write no cyber standard for it. What applies instead is the International Maritime Organization's guidance, enforced by the flag state, which the IMO itself describes as high-level recommendations. Commercial pressure is what influences owners in practice.
The FBI and Coast Guard boarded two US-bound tankers in the Gulf of Mexico between August 21 and 24, according to their joint statement, "to ensure integrity of the vessel's operational and information technology systems following indications that the networks of both vessels were compromised." The agencies reported no operational disruptions, no vessel instability, no physical danger to crews and no environmental impact. The crews and the owner's shore staff cooperated. The Coast Guard did not name the ships.
Friday's report added a significant detail. Bloomberg reported that investigators found evidence hackers had accessed the propulsion system of an oil supertanker as it approached the Texas coast, that the access was temporary, and that officials are still working out how the breach happened and who was responsible. It remains unclear how long the intruders had access or what they could have controlled. Access to a ship's propulsion system is serious, but does not establish control of it.
Reports cited in a law firm's alert say US authorities are monitoring close to 20 vessels, and that the tanker is Liberian-flagged. The rulebook says least about foreign-flagged ships.
Section 101.600 of the Coast Guard's cyber subpart in the eCFR sets its purpose as "minimum cybersecurity requirements for U.S.-flagged vessels, facilities, and Outer Continental Shelf (OCS) facilities." Section 101.605(a) applies it to the owners and operators of those vessels and facilities that must already hold a security plan under parts 104, 105 and 106. Section 101.605(b) then closes the door: "This subpart does not apply to any foreign-flagged vessels subject to 33 CFR part 104." The final rule took effect on July 16, 2025, and gives American owners until July 16, 2027 to complete their cybersecurity assessments and submit plans.
The Coast Guard explained the choice in the preamble published in the Federal Register on January 17, 2025. Cyber rules for foreign-flagged vessels under domestic law "may create unintended consequences with the ongoing and future efforts to address maritime cybersecurity in the international arena and could be contrary to international law as U.S. regulatory authority over foreign-flagged vessels is limited." It added that "the traditional means to regulate vessels on the international level is through diplomatic engagement at the IMO," which has addressed ship cyber measures through MSC-FAL.1/Circ.3 and MSC Resolution 428(98).
Foreign ships are not unregulated. Their flag states answer for them under the IMO's guidelines, and the Coast Guard retains port-state authority to board and inspect, which it used here. Those powers provide enforcement after the fact. A boarding happens once a ship is already in US waters with a suspected compromise. A rule would set the standard before arrival, give an owner something to certify against and give an inspector something to cite. For the foreign-flagged ships that bring crude to Texas, that standard does not exist, and the agency that wrote the exclusion has explained why in print.
The result is a gap that outlasts the rule. American owners have until July 2027 to put assessments and plans in place. A Liberian owner calling at the same Texas terminal answers to its flag state, and under the IMO's Resolution MSC.428(98), which "encourages administrations" to see cyber risk addressed in ships' safety management systems from the first annual verification after January 1, 2021, that means an audit by the registry, not by the Coast Guard. Guidance is only as strong as the registry that polices it.
Washington is not idle. The Coast Guard created an Office of Maritime Cybersecurity Policy in August 2026. On September 15 the House Transportation and Infrastructure Committee reported H.R. 7625, the MTS Cybersecurity Budget and Evaluation Report Act of 2026, which directs the Comptroller General to evaluate the Coast Guard's cyber budget and capabilities. Both moves point inward, at the agency's own capacity. Neither writes a requirement for a ship flying the Liberian flag.
Owners have reasons to care without a rule. Honeywell's 2026 operational technology benchmark found that nearly nine in ten maritime respondents had suffered a significant OT cyber incident in the past year. Insurers and charterers can ask the questions a regulator has declined to write into a rule, and a ship with a documented intrusion is where they will ask them first.
H.R. 7625 is a study of the Coast Guard's budget. Given the agency's stated reasoning, no binding US cyber standard for foreign-flagged tankers will be proposed before the end of 2026. The first real requirements will arrive as new questions in the vetting questionnaires that insurers and charterers send to owners, because those can be changed overnight and need no treaty.