U.S. government agencies are tracking cyberthreats against nearly 20 shipping vessels around the world, according to U.S. officials familiar with the situation.

The Coast Guard has asked for advance notice if any of those ships plan to come into a U.S. port, said the three people, who asked not to be identified because they aren’t authorized to speak publicly about the matter. The vessels’ specific destinations and manifests weren’t immediately known.

Several commercial vessels were targeted in potential cyberattacks in late August, one official at the federal Cybersecurity and Infrastructure Security Agency said, noting that hackers didn’t appear to have taken control of the targeted ships themselves. The Coast Guard is now tracking the vessels alongside FBI and Department of Homeland Security units, a Homeland Security official said.

Warnings about cyberattacks targeting the maritime sector have escalated in recent years with shipping vessels becoming increasingly dependent on digital systems for navigation, communications and other operations. Governments and security researchers have repeatedly cautioned that hackers are seeking to exploit those systems to disrupt supply chains. The cyberrisks are plaguing a global shipping industry already under strain from wars and geopolitical rivalries.

The U.S. Coast Guard said in a statement that it boarded two inbound foreign-flagged commercial vessels in the Gulf of Mexico to “ensure integrity of the vessel’s operational and information technology systems following indications that the networks of both vessels were compromised.” The first vessel was boarded on Aug. 21 to mitigate threats and the second on Aug. 24.

“Currently, there are no reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts,” the Coast Guard said, adding that it’s actively communicating with port operators, vessel owners and other stakeholders.

Antonio Cassidy, director of services at London-based maritime cybersecurity firm CyberOwl, said he hadn’t seen any indication of a broader hacking campaign targeting oil and gas tankers. But CyberOwl, which monitors cybersecurity on vessels, had observed a sharp increase in the number of incidents on ships in the first half of this year, Cassidy said.

In the case of more than half of the attempted intrusions that CyberOwl detected on the vessels it tracks, malware had been introduced to the vessels’ computers through storage devices, according to a company report. Most of the others came by way of an internet download or phishing.

In December, European investigators suspected Russian military hackers may have been behind a possible cyberattack on a vessel owned by MSC Mediterranean Shipping Co. The ferry, operated by MSC’s Grandi Navi Veloci unit, was immobilized in the southern French port of Sete as it prepared to sail to Algeria, Bloomberg reported at the time.

In March 2025, a hacker group calling itself Lab Dookhtegan claimed responsibility for cyberattacks that disrupted communications systems on more than 100 Iranian oil tankers, according to the cybersecurity firm Cydome.

Operational systems such as those inside ships are particularly vulnerable to cyberattacks because they contain old equipment that can’t easily be updated, said Maria Bartnes, cybersecurity research program director at Norwegian cybersecurity company DNV. They were created at a time when the prospect of a cyberattack was less likely, she said.

The intrusions, she said, were likely as much about creating insecurity and instability as they were intended to cause actual damage.

“That is part of the warfare,” she said, “making the enemy unsure about what is going on. For the state, for politicians, for the people on board the vessels — it can affect everyone.”