H-Line Shipping Co. Ltd.

Summary

The Vivit Africa LNG carrier experienced a systems failure that the crew reported as a suspected cyber attack while sailing from the United States toward Europe, leaving the vessel unable to access some internal control systems. After idling off the Italian coast and abandoning its planned discharge at Rovigo, the ship reversed course toward Algeciras. The Italian Coast Guard assisted following a master‑reported malfunction in cargo‑monitoring systems, and Korean Register, the technical adviser for the South Korean‑owned vessel owned by H-Line Shipping Co. Ltd., was notified. The vessel uses Kongsberg Maritime equipment for positioning, navigation and propulsion, and Vitol Group holds the ship under a time charter. Authorities are monitoring nearly 20 ships worldwide for similar threats, and two oil and gas tankers off the US coast were previously boarded by the Coast Guard and FBI due to potential cyber incidents.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The Vivit Africa LNG, a liquefied natural gas tanker owned by South Korea’s H-Line Shipping Co. Ltd., was transporting a cargo loaded at Louisiana’s Cameron LNG terminal from the United States to Europe when it entered the Mediterranean Sea in early September 2026. While sailing east through the Mediterranean and Adriatic Seas toward Italy, the crew reported that they were suddenly unable to access some of the vessel’s internal control systems. The crew characterized the incident as a suspected cyber attack and notified Korean Register, the technical and safety adviser for the South Korean‑owned vessel, early last week. Vitol Group, which holds the ship under a long‑term time charter, confirmed its involvement but did not provide further comment. Neither Korean Register nor H-Line Shipping Co. Ltd. responded to requests for comment from journalists at the time of the report. The incident prompted an ongoing investigation, though no indications of the perpetrator’s identity have been disclosed. The vessel’s cargo remained on board as the ship was unable to proceed with its planned discharge in Italy.

After idling off the coast of Italy without offloading its cargo, the Vivit Africa LNG began sailing away from its intended destination of Rovigo and headed back toward the Spanish port of Algeciras near the entrance to the Mediterranean, according to Bloomberg shipping data. The Italian Coast Guard assisted the vessel after the master reported a malfunction in the systems used to monitor cargo parameters, which required intervention by the company’s technicians. The cause of the malfunction could not be identified, and the Chioggia Coast Guard intervened solely for navigation safety purposes, issuing an urgent notice to mariners to keep their distance from the tanker. The Vivit Africa LNG is reported to be currently near Tunisia, having turned away from its original Italian route. The tanker utilizes positioning, navigation and propulsion equipment supplied by Kongsberg Maritime; a spokesman for Kongsberg stated that it is too early to draw conclusions about the cause or any security implications of the reported incident. This event follows similar reports from late August in which two oil and gas tankers off the U.S. coast were boarded by the Coast Guard and the FBI due to potential cyberattacks, and American officials are monitoring nearly 20 ships worldwide for such threats. No further details about the outcome of the investigation or the vessel’s eventual cargo disposition have been provided in the source material.

Sources

Sources available to members: 1 source.