Cyber Risk After the VL Prosperity: Where a Maritime Cyber Loss Actually Lands

On August 21 and August 24, a specialized team of Coast Guard law enforcement officers, a vessel inspector, Coast Guard cyber protection personnel, and FBI cyber operators boarded two foreign-flagged oil tankers in the Gulf of Mexico. The joint statement said the boardings were designed to ensure the integrity of each vessel's operational and information technology systems following indications that their networks had been compromised by foreign cyber actors.

One of the vessels has been identified as the VL Prosperity, a 1,093 foot Liberian-flagged crude carrier carrying roughly 2.3 million barrels from Egypt's Sidi Kerir terminal to Galveston. Iranian state media named the ship shortly after the incident and claimed hackers had penetrated its propulsion, navigation, and cargo systems and cut communications for around 30 hours while she was passing through the Strait of Gibraltar.

The U.S. account is more measured. Officials have not publicly attributed the attacks, and the joint statement said there were no reports of operational disruption, vessel instability, physical danger to crews, or environmental impact. Rear Admiral Amy Grable, who commands Coast Guard Cyber Command, confirmed to CBS News that responders found signs of malicious cyber activity once they examined the ships' IT and onboard systems.

Nobody was hurt and nothing spilled. The useful question for an operator is what would have happened to the insurance if something had.

The answer is less comfortable than most programs assume, and it differs sharply depending on whether the attack lands on a vessel or on the office.

Two Different Exposures

Maritime cyber risk sits in two places that are insured in entirely different ways:

Operational technology aboard the vessel. Propulsion control, steering, navigation, ballast and cargo management, engine monitoring, and communications. An attack here can produce physical consequences, including grounding, collision, pollution, and machinery damage. Those losses fall to the marine program, meaning hull and machinery, P&I, and war risk.

Information technology ashore. Email, accounting, booking and documentation platforms, terminal operating systems, gate systems, and payment processes. An attack here produces financial consequences such as ransomware downtime, data loss, regulatory notifications, and diverted payments. Those losses fall to commercial lines, meaning a standalone cyber policy and crime cover.

Operators frequently assume one side covers the other. Neither does, and each has its own gaps.

Hull and Machinery: The Malicious Exclusion

For more than twenty years the standard marine answer to cyber was the Institute Cyber Attack Exclusion Clause, CL380, written in 2003. It excludes loss, damage, liability, or expense directly or indirectly caused by or contributed to by or arising from the use or operation, as a means for inflicting harm, of any computer, computer system, software program, malicious code, computer virus, or other electronic system.

The words that matter are as a means for inflicting harm. CL380 targets malicious attacks. It was widely criticized as too broad and too vague, and in 2019 the Prudential Regulation Authority required insurers to state explicitly whether first party property policies covered or excluded cyber losses, with the requirement applying from January 1, 2020. That produced the LMA5402 and LMA5403 model clauses now common in hull placements.

The current position in most hull policies works like this. Malicious cyber loss is excluded. Non-malicious cyber loss, such as a software update that fails or a system that crashes without an attacker behind it, is affirmed as covered where the loss would otherwise be recoverable under the policy.

So a hull policy on standard terms would respond to a navigation system that failed on its own and would not respond to one that was hacked. On the facts described in the VL Prosperity reporting, the question of whether damage was caused by an attack would decide the claim.

Cover for the malicious element is available. Several markets offer a buyback of the cyber exclusion, and Norwegian Hull Club, for example, offers a policy responding specifically to incidents that would otherwise fall within it. It is not expensive relative to the exposure, and it is rarely bought.

P&I: No Express Exclusion, With One Important Exception

International Group clubs do not carry an express cyber exclusion. Liabilities arising from the operation of an entered vessel are generally covered whether or not a cyber event was involved.

The exception is war and terrorism. Club cover excludes liabilities caused by any hostile act by or against a belligerent power, or any act of terrorism. Liabilities from a cyber attack that falls within those words move out of club cover and into war P&I.

That matters here in a very specific way. An attack by a foreign state actor, or by a group acting for political ends, is exactly the category that may fall within the war and terrorism exclusion. Whether a particular attack qualifies depends on who carried it out and why. Terrorism under the UK Terrorism Act 2000 includes acts designed to seriously interfere with or seriously disrupt an electronic system, where the purpose is political, religious, racial, or ideological.

War Risk: The Gap in the Middle

Here is where the structure breaks down, and it is the most important point in this article.

War P&I is usually written by war risk underwriters as an extension to the hull war policy, and many of those underwriters incorporate CL380 or an equivalent. The International Group's own excess war P&I cover, which provides up to $500 million above the primary war P&I policy, does not extend to losses caused by the use or operation as a means of inflicting harm of any computer virus.

Follow that sequence through. A state-sponsored cyber attack on a vessel is excluded from club P&I because it is a war or terrorism risk. It moves to the war P&I policy, which may exclude it because it is a cyber attack. And the Group's excess war cover excludes it on the same ground.

The result can be a crew injury, a pollution liability, or a collision claim of a type the club would ordinarily cover, with no policy in the program that responds. Brokers have been flagging the possibility of an uncovered P&I risk and an unquantified balance sheet exposure since the clauses were written.

In the context of the current conflict, where Iranian state media has publicly associated itself with the VL Prosperity incident, that is not a theoretical concern.

Shoreside: Standalone Cyber and Crime

On the commercial side the exposures are more familiar and more frequent:

Ransomware and System Outage: A terminal operating system or booking platform taken offline stops the business. As we covered in our piece on business interruption, a commercial property policy requires physical damage to trigger business income cover, and a network outage is not physical damage. Cyber business interruption lives in a standalone cyber policy.

Payment Diversion and Business Email Compromise: An attacker impersonates a counterparty, often by compromising an email account, and redirects a payment for freight, hire, bunkers, or a vessel sale. This is one of the most common losses in the sector. Most standalone cyber policies and crime policies treat it separately, and social engineering fraud frequently requires a specific endorsement rather than being covered under the base form.

Data and Regulatory Costs: Breach notification, forensic investigation, legal advice, and regulatory response.

Third Party Liability: Claims by customers or counterparties whose data or operations were affected.

A standalone cyber policy responds on both sides, first party for your own losses and third party for claims against you. It is the cover that most logistics operators, forwarders, and terminal operators either lack entirely or carry at limits set years ago.

The Regulatory Layer

For U.S. operators, cyber is now a compliance obligation as well as an insurance question.

The Coast Guard's final rule, Cybersecurity in the Marine Transportation System, took effect on July 16, 2025 and is codified at 33 CFR Part 101 Subpart F. It applies to U.S.-flagged vessels, Outer Continental Shelf facilities, and facilities regulated under the Maritime Transportation Security Act.

Three deadlines matter:

Incident reporting has applied since July 16, 2025. Reportable cyber incidents must be reported to the National Response Center immediately upon discovery. The definition is broad and reaches incidents that lead to, or could reasonably lead to, a substantial loss of confidentiality, integrity, or availability of a covered information or OT system, or significant disruption to business operations.

Training applied from January 12, 2026. All personnel must complete the training specified in 33 CFR 101.650, annually thereafter, with new personnel trained within 30 days of gaining system access.

Plans are due by July 16, 2027. Owners and operators must designate a Cybersecurity Officer, conduct a Cybersecurity Assessment, and submit a Cybersecurity Plan for Coast Guard approval.

Foreign-flagged vessels are outside the rule itself, but the Coast Guard has said it will intensify port state control scrutiny of indicators of poor cybersecurity practice, particularly where they touch ISM Code compliance.

There is an insurance connection here too. As with Subchapter M, a documented and functioning cyber program is evidence underwriters can price, and a regulatory failure is the kind of fact that surfaces in a later coverage dispute.

What to Check

Read the cyber clause on your hull policy. Know whether it is CL380, LMA5403, or something else, and whether non-malicious loss is affirmed.

Ask about a malicious cyber buyback. For vessels trading in or near a conflict theater, the case for buying back the exclusion is considerably stronger than it was two years ago.

Trace a state-sponsored attack through the whole marine program. Club P&I, primary war P&I, excess war P&I, and hull war. Identify whether any policy responds and at what point the chain breaks. This is a specific exercise to do with your broker, in writing.

Confirm a standalone cyber policy is in place for the shore side, with business interruption limits set against how long your operation could actually run without its systems.

Check the social engineering position. Payment diversion is the most likely loss for most maritime businesses and the one most likely to fall between cyber and crime.

Map your Coast Guard obligations if you operate U.S.-flagged vessels or MTSA facilities, and know who reports what to the National Response Center.

Build verification into payment processes. Call back on a known number before changing bank details. It costs nothing and prevents the loss that insurance is least likely to cover cleanly.

The Bottom Line

Two tankers bound for Texas appear to have been compromised at sea, and U.S. investigators boarded both. Nothing was damaged this time.

The event is a reminder that cyber is no longer only an office problem for shipping. It reaches the systems that steer, propel, and navigate a vessel, and in a period of open conflict the actors most capable of doing that are states.

That is precisely the scenario the marine market's cyber exclusions were written to remove, and it sits in the gap between P&I and war cover in a way most owners have never traced. On the shore side, a network outage or a diverted payment falls outside the property program entirely.

Both gaps can be closed. The time to find them is at placement, not after an investigation team has boarded the ship.