Vivit Africa LNG carrier suspected cyberattack, 2026

What happened. In early September 2026, the LNG carrier Vivit Africa LNG, carrying a US cargo to the Adriatic LNG terminal off Rovigo, Italy, could not discharge. The Italian Coast Guard says her master reported a malfunction in the systems used to monitor cargo parameters, and Bloomberg reported that its cause could not be identified[1]. Her crew says the ship was hacked; that account has not been verified[2].

Why it matters. Whatever the cause, the terminal declared most of its regasification capacity unavailable for four days because an LNG carrier’s technical issue was preventing unloading[3]. The loss is documented even though the cause is not.

About this analysis. This analysis sets out what is known, stage by stage. Whether this was a cyberattack at all is not established, and the crew’s detailed account rests on a single email that the publication carrying it has not verified. This account reflects the best available information as of October 22, 2026; new information could confirm, change or discredit parts of it.

Highlights

• On September 7, the terminal operator declared that an LNG carrier’s technical issue was “currently preventing unloading” and cut its declared sendout for six gas days, to as little as about 21% of capacity[3].
• The Italian Coast Guard says the master reported a malfunction in the systems used to monitor cargo parameters, requiring intervention by the company’s technicians[1].
• The crew alleges that attackers took temporary control of steam-pressure and safety-valve systems near Gibraltar. Splash247, which published the account, has not verified it[2].
• The ship idled off Italy and left laden on September 16. No discharge anywhere had been reported by October 22[1][4].

Attack flow

• Updated: 2026-10-22
• Intent: Not established [unknown | Attack or fault, cause open]
• Threat actors: Not attributed [unknown | Attacker not established]
• Access vector: Not established [unknown | No route named]
• IT impact: Not disclosed [unknown | No IT technique in the record]
• OT targeting: Unknown [unknown | Depends on the open cause]
• OT sophistication: Unknown [unknown | Crew account unverified]
• OT impact: Loss / Denial of View [confirmed | Cargo monitoring, cause open]; Loss / Denial of Control [reported | T0813]; Manipulate Control [reported | T0831, per the crew]; Loss of Safety [reported | T0880, per the crew]
• Perils: No Perils [confirmed | No physical event reported]
• Financial losses: Business Interruption [confirmed]; Data Loss [confirmed]; Cyber Incident Response [implied]

What happened

Vivit Africa LNG is a 299-meter, Liberian-flagged LNG carrier built in 2023. Ship databases list her registered owner as Kaiser 3 SA, with H-Line Shipping of South Korea as her manager[5]; Vitol confirmed to Bloomberg that it holds her on a long-term time charter[1]. She left Cameron LNG, Louisiana, on August 20, 2026, bound for the Adriatic LNG terminal off Porto Viro, near Rovigo, where she was due on September 7[6].

In early September, the crew “were suddenly unable to access some of the internal control systems”, according to people Bloomberg did not name, and early that week they reported a suspected cyberattack to Korean Register[1]. On September 7, the terminal operator, Terminale GNL Adriatico, posted three notices of an unplanned “sendout reduction due to LNG carrier technical issue currently preventing unloading”, for gas days 8 to 13 September[3]. The notices do not name the ship. The Italian Coast Guard said it assisted after the master reported the malfunction, and that the Chioggia Coast Guard issued an urgent notice to mariners to keep their distance[1].

After idling off Italy without discharging, she began sailing back toward Algeciras on September 16, according to shipping data cited by Bloomberg; the terminal’s notices were set inactive the same day[1][3]. Bloomberg reported the story on September 18. Kongsberg Maritime, some of whose equipment the ship used, said “it is too early to draw conclusions regarding the cause or any potential security implications”[1]. On September 21, Splash247 published an email from crew members alleging an attack[2]. On September 23, an H-Line official told the Korean outlet Finomy that anomalies had affected the ship’s operating equipment generally, PCs included, and that she was waiting near Spain to discharge[7]. By October 22, tracking sites showed her in the southern Indian Ocean, and no discharge had been reported anywhere[4][8].

Intent: not established

This is the question the evidence cannot answer. The crew’s email says: “We have determined that the vessel was targeted by cyber attackers prior to berthing at this terminal”[2]. The Italian Coast Guard reports a malfunction whose cause could not be identified, Kongsberg says it is too early to draw conclusions[1], and H-Line has not singled out any product[7]. A disputed cause is recorded here as unknown, not settled by the more dramatic account. If the crew is right, the intent was malicious; if it was a fault, there was no attacker and no intent at all.

Threat actors: not attributed

No one has claimed the incident and no one has been named. Bloomberg’s sources said: “There are no indications of who the perpetrator of the suspected attack may be”[1]. Bloomberg set the incident beside two tankers boarded by the US Coast Guard and the FBI in late August over potential cyberattacks[1], and much of the coverage repeated the comparison. No official, owner or investigator has connected them. The Russian trade outlet Neftegaz.RU, which first named the ship on September 9, called it a cyberattack on the word of an unnamed source[9]; nothing it alone reports is relied on here.

Access vector: unknown

No authority, owner, manager, class society or vendor has named a way in. The ship used some Kongsberg Maritime equipment[1], which Digital Ship describes as positioning, navigation and propulsion equipment[10]; Kongsberg says it is too early to draw conclusions[1]. An H-Line official said that because the anomalies affected the operating equipment fitted on the ship generally, PCs included, it was hard to single out a specific vendor’s product[7]. None of this identifies a route, or shows that anyone got in.

IT impact: not disclosed

No source describes encryption, data theft or any other action on the ship’s IT systems, and no ransom demand or leak threat has been reported. H-Line’s remark that the anomalies reached PCs as well as operating equipment[7] describes how far the fault ran, not an IT technique. Whether anyone crossed from IT into the ship’s control systems is not established, because whether there was an attacker is not established.

OT targeting: unknown

Any targeting value presumes an attacker, and that is not established. If the crew’s account holds, this would be a direct compromise of the ship’s control systems[2]; if it was a fault, there was no targeting at all. What is confirmed is that the trouble was in OT: the Italian Coast Guard places the malfunction in the systems that monitor cargo parameters, which needed the company’s technicians[1].

OT sophistication: unknown

If the crew’s account is right, the attack would sit at the sophisticated end. The email alleges that attackers “gained temporary control of the steam pressure and safety valve systems” during the transit of the Strait of Gibraltar, then compromised tank pressure control and pressure relief valves and disrupted the boil-off gas management cycle in the Adriatic[2]. That would be interference with protection and safety functions. Nothing verifies it: Splash247 says it “has not independently verified the crew’s claims”[2].

OT impact: a loss of view, and claims of more

One effect is confirmed: the master reported a malfunction in the systems used to monitor cargo parameters, and its cause could not be identified[1]. Cargo parameters, such as tank levels, temperatures and pressures, are what keep a gas cargo safe and what measure a transfer. The malfunction is shown as Loss / Denial of View.

Three more effects are reported only. People Bloomberg did not name say the crew could not access some internal control systems, shown as Loss / Denial of Control[1]. The crew’s email describes interference with tank pressure control, shown as Manipulate Control, and temporary control of safety-valve systems, shown as Loss of Safety[2]. None is corroborated by an authority, the manager or the equipment vendor.

Perils: no physical event

No overpressure, relief-valve lift, venting, fire, explosion, damage or injury has been reported by anyone. The crew warned that the interference “significantly increases the risk of tank rupture and explosion”[2]. That describes a risk, not something that happened, so explosion and pressure failure are not shown even as reported. The Coast Guard says it intervened “solely for navigation safety purposes”[1].

A cargo that did not arrive is a loss whether the cause was an attacker or a fault.

Financial losses: no figure disclosed

No figure of any kind has been disclosed by the owner, the manager, the charterer, the terminal or any authority. The confirmed losses are a delivery that did not happen and a malfunction that needed the company’s technicians to fix[1][3]. Who bears the cost of the delay and the longer voyage is not disclosed.

Loss evidence

• Confirmed: Lost revenue and productivity (cargo not discharged at the terminal and no discharge reported by October 22); Production data integrity (cargo-monitoring malfunction); Third-party physical and societal impact (the terminal’s declared sendout cut, about 1,058 GWh of capacity by our sum, and an urgent notice to mariners)
• Implied: Manual operations and workarounds; Contract violation or obligation; Network event response and recovery
• Not supported: Business interruption liability; Cyber-physical event response; Industry regulation liability; Cyber-physical cover response; Equipment repair and replacement; Startup and return-to-service validation; Bodily injury; Spills and cleanup; Ransom extortion

No insurer, claim or cover position has been reported. Gard’s register shows the ship entered with Gard for P&I, with no casualty listed[11].

What this incident shows

The case is recorded for what is certain whatever the cause: a control-system failure on a laden gas carrier cost a delivery, and the terminal declared most of its capacity unavailable for four days because an LNG carrier’s technical issue was preventing unloading[1][3]. The loss did not wait for an answer to whether there was an attacker.

It also shows how far a dramatic account can run ahead of the evidence. The most repeated detail, safety valves taken over near Gibraltar, rests on one crew email that its publisher has not verified[2], while the Coast Guard, the equipment vendor and the manager have offered no cause[1][7]. Until an investigation reports, the facts that matter for assessing this kind of risk are the confirmed ones: what failed, and what it stopped.

References

1. Soon, Weilun, Ruth Liao, and Charles Gorrivan. “Another Tanker Suffers Failure as Crew Suspect Cyber Attack.” Bloomberg, as carried by Claims Journal, 19 Sept. 2026. claimsjournal.com/news/national/2026/09/19/340232.htm
2. Chambers, Sam. “Crew Claims Hackers Seized Control of LNG Carrier Safety Systems.” Splash247, 21 Sept. 2026. splash247.com/crew-claims-hackers-seized-control-of-lng-carrier-safety-systems/
3. Terminale GNL Adriatico S.r.l. “Regasification Plant Unavailability.” UMM 26090721X000000001360B001, B002 and B003, GIE Inside Information Platform, 7 Sept. 2026 (inactive from 16 Sept. 2026). iip.gie.eu/details/26090721X000000001360B001_001
4. “Vivit Africa LNG: Liquid Bulk Carrier & Details and Current Position, IMO 9950105.” ShipNext, read 22 Oct. 2026. shipnext.com/vessel/9950105-vivit-africa-lng
5. “VIVIT AFRICA LNG Gas Carrier Ship: IMO 9950105 / MMSI 636022258.” MagicPort, read 22 Oct. 2026. magicport.ai/vessels/tanker/vivit-africa-lng-mmsi-636022258
6. Schappert, Stefanie. “Hackers Gain Brief Control over LNG Vessel Safety Systems near Gibraltar.” Cybernews, 21 Sept. 2026, updated 24 Sept. 2026. cybernews.com/news/fbi-fuel-tanker-attacks-hackers-gain-control-critical-systems/
7. Kim, Sung-hoon. “에너지 운반선 잇단 사이버 침해···현존선 보안관리 중요성 경고등 [Successive cyber intrusions on energy carriers: a warning on security management for existing ships].” Hyundai Economic Daily (Finomy), 23 Sept. 2026. finomy.com/news/articleView.html?idxno=262164
8. “VIVIT AFRICA LNG: Tanker (IMO: 9950105, MMSI: 636022258).” MyShipTracking, read 22 Oct. 2026. myshiptracking.com/vessels/vivit-africa-lng-mmsi-636022258-imo-9950105
9. Alifirova, E. “Кибератаки на танкеры-газовозы угрожают энергетической безопасности Европы и поставкам СПГ из США [Cyberattacks on gas carriers threaten Europe’s energy security and LNG supplies from the US].” Neftegaz.RU, 9 Sept. 2026. neftegaz.ru/news/Suda-i-sudostroenie/935706-kiberataki-na-tankery-gazovozy-ugrozhayut-energeticheskoy-bezopasnosti-evropy-i-postavkam-spg-iz-ssh/
10. Murga, Arnel. “Three Tanker Cyber Incidents in a Month Put Shipboard Systems under Scrutiny.” Digital Ship, 21 Sept. 2026. thedigitalship.com/news/maritime-satellite-communications/three-tanker-cyber-incidents-in-a-month-put-shipboard-systems-under-scrutiny/
11. “Vivit Africa LNG: Vessels.” Gard, read 22 Oct. 2026. gard.no/vessels/512739/