Two late-August incidents disclosed this week open a maritime risk channel that has nothing to do with missiles or drones, and that existing war-risk insurance was not written for.
U.S. Coast Guard and FBI investigators are examining cyberattacks on two oil tankers bound for the American coast, in incidents that occurred in late August and are only now being disclosed.
In the first, on August 21, a foreign-flagged commercial vessel had its network compromised while transiting the Strait of Gibraltar, losing communications for more than 30 hours. The vessel was bound for Texas. In the second, on August 24, a separate tanker was boarded after similar activity was detected.
Officials have stated there were no reports of operational disruption, vessel instability, physical danger to crew or environmental impact in either case. Investigators are examining, without having confirmed, whether Iran or another actor exploiting the current Iran and U.S. conflict was involved. Vessel names, flag states and operating companies have not been disclosed in any account made public.
Why a 30-hour blackout matters even without damage
A tanker that loses communications for 30 hours in a strait is not a ship in danger in any immediate sense. It is a ship that its owner, its charterer, its insurer and the relevant navies cannot see, account for or contact. Every commercial and regulatory structure built around modern shipping assumes continuous position reporting.
That is the part with financial consequences. Marine war-risk premiums in the Gulf region have already moved sharply, with per-transit costs for the most exposed routes now described in the double-digit millions of dollars. Those premiums were repriced for a kinetic threat: missiles, drones, boarding parties. A demonstrated ability to disable a vessel's network from outside the theatre, in the Mediterranean approaches rather than the Gulf, is a different exposure, and it is not geographically contained the way the current war-risk zones are.
The context this lands in
It arrives alongside a Gulf shipping picture that is already stressed. Major container and tanker operators have suspended Hormuz transits. Vessel traffic through the strait has thinned dramatically, with one count showing four ships transiting on a recent Monday against a historical baseline near 125 a day.
Tanker freight rates have moved accordingly, with at least one freight-focused fund reported up sharply on the year. A second, non-kinetic threat vector layered on top of that does not need to sink anything to raise the cost of moving energy.
What comes next
The investigations are ongoing and no attribution has been made. The immediate commercial question is whether marine underwriters begin pricing cyber exposure separately from war risk, and whether the incidents recur. Neither has been answered.