Cyber Attacks on Tanker Ships: What Emergency Managers Need to Know

Published September 17, 2026. For current incident information, use the official sources linked in this article.

When two tanker ships transiting the Strait of Gibraltar en route to United States ports were hit by coordinated cyber attacks, it wasn't just a maritime security incident. It was a warning shot for emergency managers, port authorities, and supply chain continuity planners across the country.

This post examines what happened, why it matters to the emergency management community, and what planners at every level should be doing right now to prepare for cyber-enabled disruptions to critical infrastructure.

The Incident: What We Know

The two vessels, both carrying cargo destined for US ports, experienced simultaneous disruptions to their navigation and communications systems while transiting the Gibraltar Strait — one of the most heavily trafficked and strategically significant chokepoints in global shipping. The attacks targeted onboard systems, causing navigational uncertainty and forcing the ships to rely on manual procedures while authorities investigated the source and scope of the intrusion.

While attribution remained under investigation, the incident highlighted a well-documented vulnerability: modern commercial vessels run complex, networked systems — GPS, AIS (Automatic Identification System), ECDIS (Electronic Chart Display and Information System), and engine management — that were not originally designed with cybersecurity in mind.

Why This Matters to Emergency Managers

It is tempting to view a maritime cyber incident in the Strait of Gibraltar as someone else's problem. It is not.

The United States imports billions of dollars in goods through its coastal ports every month. A disruption to vessels inbound to major ports — Los Angeles, Houston, Savannah, Baltimore, New York/New Jersey — creates cascading effects that reach far inland within days. Fuel, medical supplies, industrial components, and food commodities all move through these maritime chokepoints.

For emergency managers, the relevant question is not whether a cyber attack on a ship is a Coast Guard problem. The question is: what happens to your jurisdiction when the supply chain feeding it is disrupted for days or weeks?

The ICS Angle: Unified Command in a Cyber-Maritime Incident

A cyber-enabled maritime incident that threatens port operations or inbound cargo creates a complex, multi-jurisdictional response environment. Under the National Incident Management System (NIMS), this type of incident would typically fall under a Unified Command structure involving:

• US Coast Guard Sector Command — primary federal maritime authority
• FBI Cyber Division — if a criminal or nation-state cyber actor is involved
• CISA (Cybersecurity and Infrastructure Security Agency) — critical infrastructure protection lead
• State and local emergency management — consequence management for port community and supply chain disruption
• Private sector — port operators, terminal operators, shipping companies, and logistics providers

Emergency managers who have never participated in a maritime cyber exercise may find themselves in this Unified Command structure with little preparation. That gap needs to close.

Supply Chain Disruption: The Consequence Management Challenge

Most jurisdictions have commodity-specific emergency plans — fuel shortages, food bank activations, medical supply contingencies. Few have tested those plans against a scenario where multiple inbound vessels are delayed or unable to enter port for an extended period.

Key questions your plan should be able to answer:

• What critical commodities does your region receive by sea, and what is the buffer stock if inbound shipments stop for 7, 14, or 30 days?
• Do you have relationships with alternate suppliers or overland logistics providers who could surge capacity?
• What is your public communication plan if fuel or food supply disruptions become visible to the public?
• Have you coordinated with your state's port authority and the Coast Guard Sector on joint planning?

Cyber Threats to Maritime Infrastructure: A Growing Pattern

The Gibraltar incident is not an outlier. The maritime sector has seen a significant rise in cyber incidents over the past several years:

• The 2017 NotPetya attack devastated Maersk, the world's largest shipping company, taking down 45,000 PCs and 1,000 applications and disrupting port operations globally
• The Port of Houston was targeted in a cyber attack in 2021
• GPS spoofing incidents in the Black Sea and Persian Gulf have repeatedly confused vessel navigation systems

The pattern is clear: adversaries — whether criminal, nation-state, or hacktivist — have identified maritime infrastructure as a high-value, relatively soft target. Emergency managers need to treat maritime cyber incidents as a credible, planning-worthy threat — not a hypothetical.

What You Can Do Now

• Connect with your Coast Guard Sector. Most sectors have a Port Security Committee or Area Maritime Security Committee (AMSC) that includes state and local emergency management. If you are not at that table, get there.
• Review your supply chain dependencies. Conduct a commodity flow analysis for your jurisdiction. Identify which critical goods arrive by sea and what the realistic buffer time is before shortages become consequences.
• Exercise the scenario. Add a cyber-enabled port disruption inject to your next tabletop exercise. Even a two-hour discussion will surface gaps you didn't know existed.
• Build relationships before the incident. Port operators, terminal managers, and logistics providers are your partners in consequence management. Those relationships are built in peacetime, not during the response.
• Stay current on CISA maritime guidance. CISA regularly publishes advisories and resources specific to maritime cybersecurity. Incorporate them into your planning cycle.

The Bottom Line

The cyber attacks on two tankers near Gibraltar are a reminder that the threat environment for emergency managers now extends well beyond traditional natural hazards and into the digital domain — and that the consequences of cyber incidents increasingly land in the physical world, affecting the supply chains, infrastructure, and communities that emergency managers are responsible for protecting.

Preparedness is not just about having the right gear in the field. It is about understanding the threat landscape and closing the gaps in your plan before an incident forces you to.

Response Depot supports emergency managers with consulting, planning resources, and professional-grade field gear. Contact us to discuss how we can support your planning program.