U.S. government agencies are reportedly tracking cyber threats against nearly two dozen ships worldwide, according to three individuals familiar with the situation who requested anonymity due to lack of authorization to discuss the matter publicly.

The U.S. Coast Guard has instructed that advance notification be provided if any of these vessels plan to enter American ports, the sources said. Specific destinations and cargo manifests for the ships remain undisclosed at this time.

An official from the U.S. Cybersecurity and Infrastructure Security Agency noted that several commercial vessels were targeted for potential cyberattacks in late August, emphasizing that hackers have not appeared to gain actual control of the ships. A Homeland Security Department official added that the Coast Guard, in collaboration with the Federal Bureau of Investigation and related divisions within the department, is actively tracking these vessels.

In recent years, warnings about cyberattacks on the maritime industry have escalated as ships increasingly depend on digital systems for navigation, communication, and other operational functions. Governments and security researchers have repeatedly cautioned that hackers are attempting to exploit these systems to disrupt global supply chains. Cyber risk is becoming a fresh challenge for the global shipping sector, which is already strained by warfare and geopolitical competition.

In its statement, the U.S. Coast Guard said it boarded two foreign commercial vessels heading to the U.S. in the Gulf of Mexico to "ensure the integrity of the vessels' operational systems and information technology systems," following indications that both ships' networks had been breached. The first ship was inspected on August 21, with the second undergoing checks on August 24. The Coast Guard reported: "No operational disruption, loss of stability, threat to crew safety, or environmental impact has been identified." It also noted close communication with port operators, ship owners, and other stakeholders.

Antonio Cassidy, service director at London-based maritime cybersecurity firm CyberOwl, stated that he has not observed indications of a large-scale hacking campaign targeting oil and gas transport vessels. However, CyberOwl has recorded a notable uptick in cybersecurity incidents in the maritime sector during the first half of this year. According to the company's report, more than half of detected intrusion attempts on tracked ships involved malware inserted into onboard computer systems via storage devices, with the majority of other cases stemming from internet downloads or phishing attacks.

In December of last year, European investigators suspected Russian military hackers may have been involved in a cyberattack on a vessel operated by Mediterranean Shipping Co (MSC)'s Grandi Navi Veloci unit, which was forced to remain docked at Sete port in southern France despite an intended journey to Algeria, as media reports at the time indicated. Cybersecurity firm Cydome reported that in March 2025, a hacking group known as Lab Dookhtegan claimed responsibility for a cyberattack that disabled communication systems on over 100 Iranian oil tankers.

Maria Bartnes, research director for cybersecurity at Norwegian firm DNV, explained that ship operational control systems are particularly susceptible to cyberattacks because they contain large amounts of outdated equipment that is difficult to update. These systems were largely created in an era before cyber threats were prominent. She suggested that such intrusions aim less at causing physical damage and more at fostering uncertainty and instability. "This is part of warfare itself," she said, "by making it impossible for opponents to discern what is truly happening. States, political figures, and crew members on board could all be affected."