Vivit Africa LNG: What Is Known About the Suspected Cyber Incident on an H-Line LNG Carrier
A crew reported a cyber attack, the coast guard recorded a malfunction, and the cause is still not established. Why that gap is itself the lesson.
In early September 2026 the LNG carrier Vivit Africa LNG, owned by South Korea's H-Line Shipping, lost access to some of its control systems while approaching Italy with a US cargo. The crew reported a suspected cyber attack. The Italian Coast Guard recorded a malfunction whose cause could not be identified. The ship left without discharging. As of 30 October 2026 I could find no published finding, so this is an unconfirmed incident, and it should be read that way.
Ⅰ. What Happened
| Vessel | Vivit Africa LNG, LNG carrier, reported as Liberia-registered |
| Owner / charterer | H-Line Shipping Co. Ltd. (South Korea) / Vitol Group, long-term time charter |
| Voyage | Loaded at Cameron LNG, Louisiana, for the Adriatic LNG terminal near Rovigo, Italy |
| Early September | Crew suddenly lost access to some internal control systems as the ship neared its destination, and reported a suspected cyber attack to Korean Register |
| Off Italy | Chioggia Coast Guard issued an urgent notice to mariners to keep clear; company technicians intervened |
| 16 September | After idling without discharging, the ship turned west toward Algeciras, Spain, and was later tracked near Tunisia |
| Attribution | None. Reports say there are no indications of who a perpetrator might be. |
Ⅱ. Confirmed, Reported, Alleged
The accounts differ, so it helps to separate them by how strong each one is.
| Level | Claim | Source |
|---|---|---|
| Official | The master reported "a malfunction in the systems used to monitor cargo parameters". The cause "couldn't be identified". The Coast Guard "intervened solely for navigation safety purposes". | Italian Coast Guard, Capt. Roberto D'Arrigo, via Bloomberg |
| Reported | Crew lost access to some internal control systems and reported a suspected cyber attack. Investigations are ongoing. | Bloomberg, citing people familiar with the matter |
| Alleged | Attackers "gained temporary control of the steam pressure and safety valve systems" during the Strait of Gibraltar transit. Later interference with tank-pressure controls and boil-off gas management is also alleged. | Crew members, via Splash247. Not independently verified. |
| Vendor | "It is too early to draw conclusions regarding the cause or any potential security implications." | Kongsberg Maritime, supplier of some positioning, navigation and propulsion equipment |
| No comment | Vitol confirmed the charter and declined further comment. H-Line and Korean Register did not immediately respond to Bloomberg. | Bloomberg |
One open point: a Korean press report of 26 October (Asia Economy) describes an LNG carrier built by HD Hyundai Samho and managed by H-Line as hit by a suspected hack "early this month", without naming the ship. I could not confirm whether that is this same event with a different date, or a separate one.
Ⅲ. The Wider Pattern, and Its Limits
Vivit Africa LNG was reported as the third suspected tanker incident in about a month:
| Ship | Type | Event | Status |
|---|---|---|---|
| VL Prosperity | VLCC | Crew-reported events during the Strait of Gibraltar transit on 7 Aug; boarded by USCG and FBI on 21 Aug | USCG confirmed malicious cyber activity; no public attribution |
| Kohaku | LPG carrier | Boarded three days after VL Prosperity under similar circumstances | No operational disruption or physical danger reported by US authorities |
| Vivit Africa LNG | LNG carrier | Control access lost in early Sep; Italian discharge not completed | Cause not established |
US officials are also reported to be monitoring nearly 20 ships worldwide for similar threats. See also my earlier analysis of the VL Prosperity attack.
Ⅳ. Why the Disputed Cause Is the Real Lesson
Whatever the investigators conclude, this case shows a problem every operator shares: when a control system fails at sea, the crew often cannot tell quickly whether it is a fault or an attack. That answer changes what they should do next:
| Decision | If it is a fault | If it may be an attack |
|---|---|---|
| Restart / reboot | Often the first fix | May destroy evidence, and may reinfect |
| Vendor remote support | Normally helpful | The remote link may be part of the problem |
| Isolate networks | Rarely needed | May be essential, but can affect other systems |
| Who to call | Technical superintendent | Also the cyber response lead, class and flag |
A ship cannot wait for a forensic report to make those decisions. It needs a default it can act on while the cause is unknown. On an LNG carrier the stakes are higher, because cargo pressure and boil-off have to be managed continuously, whatever the cause of the fault. Losing monitoring is an operational problem well before anyone proves a cyber attack. The planned discharge in Italy was also not completed. The reason the ship turned back has not been explained, but the outcome shows how much disruption is possible without any confirmed takeover.
Ⅴ. Where IACS UR E26/E27 Fits
The public reports do not give this ship's contract date, so I cannot say whether UR E26 and E27 apply to her, and nothing here suggests any failure against them. As a reference for any operator, though, UR E26's Detect, Respond and Recover requirements speak directly to this scenario:
- Detect: could the crew distinguish abnormal network activity from a sensor or controller fault, using logs they can actually reach?
- Respond: E26 expects an incident response plan, local independent or manual operation, network isolation, and a fallback to a minimal risk condition. Has your crew drilled these for cargo systems, not only for navigation?
- Recover: are there tested backups and a recovery plan that a technician can use on board?
Ships outside E26 scope have no such class requirement, but the same questions apply under their ISM-based cyber risk management.
Ⅵ. What Operators Can Do Now
- Write a one-page "fault or attack?" card for the ECR and CCR: what to record before any restart.
- Define who may authorise network isolation, and which systems must stay running if it happens.
- Drill loss of cargo monitoring with manual readings and local control, with a time target.
- Confirm that logs from cargo and automation systems are retained on board long enough to be useful.
- Agree in advance how vendor remote support is approved during a suspected incident.
- Decide who reports to class, flag, charterer and coastal state, and what they say while the cause is unknown.
We may learn that Vivit Africa LNG was attacked, or that it was not. Either way, a crew faced a failing control system and had to act without knowing which. Preparing for that moment does not depend on the investigation's result. I will update this article if Korean Register, H-Line or the authorities publish findings.
- Bloomberg via gCaptain: Another Tanker Suffers Failure as Crew Suspect Cyber Attack (18 Sep 2026)
- Bloomberg via Insurance Journal (18 Sep 2026)
- Splash247: Crew claims hackers seized control of LNG carrier safety systems
- Digital Ship: Three tanker cyber incidents in a month (21 Sep 2026)
- Ship Universe: summary of the crew claims (21 Sep 2026)
- The Next Web: Third tanker in a month hit by a suspected cyber incident (18 Sep 2026)
- Asia Economy (Korean, 26 Oct 2026)
Specialises in OT/IT cyber security and IACS regulatory analysis for the shipping and shipbuilding industries. Tracks maritime cyber incidents, CVEs and threat intelligence for ships, ports and shipping companies.
🛡️ More Threat Trends ↗⚓ Join the ShipPaulJobs Community
Join →
Comments
Post a Comment