INSIGHT

What the Latest Maritime Cyberattacks Reveal About Your Cybersecurity Blind Spots 

Josh Schmidt • October 12, 2026

Services: Cybersecurity Risk Assessments

---

U.S. Coast Guard and FBI cyber teams boarded two oil tankers bound for Texas in August, four days apart, after investigators found signs that the vessels’ onboard networks had been compromised by outside actors. Officials have not named a culprit, and the investigation remains open.  

But the vulnerability behind these boardings deserves attention well beyond the maritime industry: these ships run navigation, propulsion, and cargo systems on the same network that carries everyday IT and satellite connectivity, often behind a single firewall. That same blended setup shows up in plants, ports, and distribution centers far from open water, which means the gap that exposed these tankers could just as easily be sitting inside your own network.  

Two Boardings, One Pattern  

The two vessels, both arriving in the Gulf of Mexico, were boarded on August 21 and August 24 by a joint team of Coast Guard cyber specialists and FBI Cyber Action Team operators. Officials have reported no operational disruption, no danger to the crews, and no environmental impact. What they have confirmed is that the boardings were necessary to verify the integrity of each vessel’s operational and information technology systems after indications of a breach.

The attribution question remains unresolved, and a nation-state campaign and a criminal group’s attack are very different types of cyberattacks to defend against. Modern tankers often run navigation, propulsion, steering, and cargo systems on the same onboard network that carries IT and satellite connectivity, frequently behind a single firewall. One network, one point of failure, and a lot riding on it.  

A New Federal Deadline Raises the Stakes  

The timing puts a spotlight on a rule the Coast Guard has been phasing in since 2025. Under 33 CFR Part 101, Subpart F, owners and operators of U.S.-flagged vessels, facilities, and Outer Continental Shelf facilities that already maintain a security plan are now working through a staggered set of cybersecurity compliance requirements. Reportable cyber incidents have had to go to the National Response Center since the rule took effect, annual personnel training became mandatory in January 2026, and by July 16, 2027, covered operators must designate a Cybersecurity Officer, complete a formal Cybersecurity Assessment, and submit a Cybersecurity Plan under Section 101.650(e).  

That 2027 deadline sits on top of baseline measures already in force, including:  

• Account security, such as multifactor authentication, least-privilege access, and removing credentials the moment someone leaves the organization  
• Device security, including an approved hardware and software list and an accurate, current network map  
• Data security, covering encrypted traffic and logs that are captured, retained, and accessible only to privileged users  

Worth noting: the rule’s reach has a limit. Foreign-flagged vessels, like the two tankers boarded last month, are excluded from Subpart F under Section 101.605(b). The mandate applies to the U.S.-flagged side of the industry. That distinction does not make the underlying risk any less real for anyone running blended networks; it just means the assessment and plan requirements will land on domestic operators first.  

Where the Real Risk Lives: The Space Between IT & OT  

Security researchers who track operational technology risk have pointed to the same structural issue behind these tanker incidents: when navigation, propulsion, and cargo systems share a network with business IT and satellite links, a single compromised credential or an unpatched connection can carry an attacker much further than anyone planned for. That is not a maritime-specific problem, as the recent cyberattacks on U.S. water systems made clear. BPM’s cybersecurity team has found the same pattern during on-site assessments of critical infrastructure operators on land, where an unsecured wireless access point or an undocumented path between the business network and a control system was the only thing standing between routine IT traffic and equipment that keeps something physical running.  

“The tanker story is really an IT and OT story that happened to take place on a ship,” said Joshua Schmidt, Partner, Cyber and IT Advisory at BPM. “Any organization running blended networks, whether that is a treatment plant, a distribution center, or a factory floor, should read this as a preview of the questions its board, its insurer, or a regulator is about to start asking.”  

This Reaches Well Beyond the Maritime Sector  

You do not need a Cybersecurity Assessment deadline on your calendar to have the same exposure the Coast Guard is now regulating. Manufacturers, utilities, logistics operators, and any organization running Internet-connected equipment alongside standard business systems face the identical question: what is on your network, who can reach it, and can you prove it if a regulator, an insurer, or a board member asks. Insurance underwriters are already pricing that uncertainty into renewals, and boards are asking for documentation, not assurances.  

Find Your Gaps Before Someone Else Does  

A one-time assessment tells you where your gaps are today. Closing them, and keeping them closed as your systems and vendors change, takes ongoing attention. BPM pairs hands-on cybersecurity risk assessment services, built on the same asset-mapping and network-testing approach that uncovers undocumented paths between IT and OT, with Managed IT services that maintain the fixes: monitoring, patching, access reviews, and documentation that holds up when an auditor, insurer, or regulator comes asking.

If your organization runs any mix of operational technology and business IT, do not wait for a boarding, an audit, or a headline to find out where your network can be reached from. Connect with BPM’s Cybersecurity team to talk through an assessment built around how your systems truly connect.