Washington — U.S. Probes Suspected Iran Link to Tanker Cyberattacks

U.S. investigators are examining a suspected Iranian link to cyberattacks on energy tankers that were transiting the Strait of Gibraltar en route to American ports, according to The Wall Street Journal. The Journal reported that the vessels were attacked in the strait as they made their way toward the U.S. coast, without specifying the number of ships involved or the exact date of the incidents.

What happened to the tankers bound for U.S. ports?

According to the Journal's reporting, the tankers were struck by cyberattacks while passing through the Strait of Gibraltar, the narrow waterway connecting the Atlantic Ocean to the Mediterranean Sea that ships bound for the U.S. from Middle Eastern and European loading points typically transit. The Journal's account does not detail the specific systems targeted aboard the vessels or describe the operational impact of the intrusions.

"The vessels were attacked in the Strait of Gibraltar as they made their way to U.S. ports."

That single line from the Journal's reporting is the most specific public description available of the incident sequence as of Sept. 20, 2026.

Why is Iran suspected in the attacks?

U.S. authorities are treating a potential Iranian connection as a working theory in the investigation, per the Journal's headline framing of the probe. The published excerpt reviewed for this report does not include additional detail on the evidence tying the attacks to Iranian state or proxy actors, and the Journal has not published attribution specifics in the material available.

Which agencies are leading the investigation?

The available reporting does not name a specific federal agency — such as the Coast Guard, the Cybersecurity and Infrastructure Security Agency, or the FBI — as the lead investigator. The Journal's account confirms only that a U.S. probe is underway into the cyberattacks and their possible state-backed origin.

Why does the Strait of Gibraltar matter for U.S.-bound energy shipments?

The strait sits at a chokepoint used by tankers moving crude and refined products from the Mediterranean and North Africa toward U.S. Gulf Coast refining hubs. A successful cyber intrusion against a vessel's navigation or control systems in that corridor could, in principle, affect scheduling or safety for shipments continuing across the Atlantic, though the Journal's reporting reviewed here does not quantify any delay, cargo loss, or safety incident tied to the attacks.

What happens next in the U.S. probe?

No timeline for the investigation's conclusion, and no findings on Iranian involvement, have been made public in the reporting available. The Journal's story remains the primary sourced account of the matter as of this writing, and any additional agency statements or attribution findings would mark the next disclosure point in the inquiry.

This report is based on a single sourced account; additional details on vessel identities, dates, and agency involvement were not available at publication.