A cyberattack on a U.S. oil pipeline has raised alarms—cybersecurity is a critical issue for the future.

Seventeen U.S. states—including Washington, D.C.—declared states of emergency. Not due to military invasion, nor because of a massive natural disaster—but because a hacker group attacked America’s oil pipeline infrastructure. This incident is not merely a spectacle for us to watch; rather, it offers valuable lessons and warnings from the United States. It demonstrates that, in a complex and highly sophisticated modern society, cyberattacks can inflict enormous damage. First, the U.S. boasts relatively advanced cybersecurity and computer protection capabilities—among the world’s best, at least compared with many other nations. Yet even its energy infrastructure was forced to halt operations due to this incident. This clearly shows how increasingly severe modern cyberattacks and hacking crimes have become threats to societal critical infrastructure, fundamental operations, and public safety. Moreover, we must recognize that many cyberattacks depicted in films, novels, and news reports are no longer fictional—they have evolved into massive, tangible threats. We all know that the U.S. frequently conducts cyberattacks against other countries—and China is among its key targets. Yet today, even the ‘architect’ of global cyberattacks has proven alarmingly vulnerable to such attacks—underscoring just how grave the situation has become. The challenges confronting the U.S. may well confront China in the future. Indeed, China may face not only criminal hacking groups but also state-sponsored actors operating behind the scenes. Chinese society and relevant institutions must therefore conduct thorough assessments of cybersecurity—especially regarding the cybersecurity of critical infrastructure. Such assessments must cover the potential impacts of internet-based attacks on power plants, oil pipelines, transportation systems, pipelines, aviation, and other vital facilities.

116 tankers paralyzed by cyberattack! How can maritime cybersecurity defenses be strengthened?

I. Review of the Cybersecurity Incident In March 2025, 116 tankers operated by two major Iranian shipping companies suffered the largest-scale cyberattack in maritime history. A hacker group infiltrated the vessels’ satellite communication systems (VSAT terminals), severed ship-to-shore data transmission, and erased critical configuration files—rendering crew coordination impossible. The attack exposed two major vulnerabilities in maritime networks: weak default passwords on satellite terminals and insufficient security isolation between IT and OT systems. Beyond severely disrupting Iran’s oil exports, this incident sounded a global alarm for the shipping industry—cyberattacks on vessels have evolved from ‘virtual threats’ into ‘physical risks.’ 1. Technical Attack Chain Breakdown ① Initial Breach Hackers exploited default weak passwords and unpatched firmware vulnerabilities in vessel VSAT terminals to remotely seize device control. Many such terminals use outdated models lacking strong authentication or regular updates. ② Lateral Movement By leveraging the satellite terminal’s connection to the vessel’s internal network, attackers exploited unisolated interfaces between IT systems (e.g., crew management platforms) and OT systems (e.g., propulsion control), deploying malicious scripts to progressively hijack navigation, propulsion, and other core systems. ③ Disruption Phase ・ Data Erasure: Critical configuration files—including electronic nautical charts and communication protocols—were deleted from navigation systems, depriving vessels of positioning capability. ・ Protocol Tampering: The satellite terminal’s communication protocol library was overwritten, blocking all ship-to-shore data transmission—preventing crews from receiving instructions or sending distress signals. 2. Real-World Impacts and Cascading Effects ① Direct Losses ・ The grounding of 116 tankers caused a sharp decline in Iran’s oil export volumes. ・ Crews were forced to rely on paper charts and manual steering, drastically reducing navigational efficiency and significantly increasing collision risk. ② Industry-Wide Impact ・ International marine insurers raised premiums for Iranian-flagged vessels; some shipping routes were suspended entirely. ・ Ports across multiple countries intensified inspections of vessel communication equipment, delaying cargo handling and undermining global supply chain efficiency. 3. Historical Context: The Evolution of Maritime Cyber Threats This incident is no isolated case—it reflects the broader escalation of maritime cyber threats in recent years. According to a report by DNV Cyber, cyberattacks surged markedly in 2024: on average, each shipping company experienced a cyberattack every five days, enduring approximately 65–80 incidents annually—including system outages, suspicious activities, or insider threats—that could trigger full system failures or even force vessels to halt operations. II. Vessel Network Architecture and Security Risks 1. Internal Vessel Network Architecture As illustrated in Figure 2, a vessel’s internal network architecture comprises three layers: the vessel network control layer, the integrated vessel management layer, and the crew office network layer. Source: Wu Zhongdai, Wang Zhenhui, Han Dezhi, Han Bing, Chen Peng. “A Review of Cybersecurity and Protection Technologies for Intelligent Vessels.” Ship Science and Technology, 2024, 46(10): 1–8. 2. Emerging Risks With the advancement of digitalization and intelligence in shipping, vessel computing paradigms have undergone profound transformation—from early standalone, air-gapped systems, to local area network (LAN)-connected setups, and now to internet-connected architectures. While this evolution has greatly enhanced shipping efficiency and profitability, it has simultaneously introduced a host of cybersecurity concerns. On one hand lie inherent security risks arising from internal system design and implementation; on the other, internet connectivity introduces severe external threats—including Advanced Persistent Threats (APTs), rampant ransomware, data theft, and data tampering. As a result, maritime cybersecurity has grown increasingly precarious—now constituting a critical bottleneck impeding the sustainable and stable development of the entire maritime industry.

Hackers Breach Propulsion System of US-Bound Oil Tanker

Oct 2, 2026

FBI and Coast Guard confirmed hackers accessed the propulsion system of the VL Prosperity oil tanker approaching Texas. The incident underscores growing physical risks from cyberattacks targeting the energy shipping sector.

bloomberg

2026-09-15

US Coast Guard Boards Oil Tanker in Cyber Attack Investigation

2026-10-02

Hackers Breach Propulsion System of US-Bound Oil Tanker

Hackers Breach Propulsion System of US-Bound Oil Tanker

FAQ