Cyberattack on US LNG shipment holds gas reserves hostage on the eve of winter / US labelled an “unreliable supplier”

On September 9, 2026, Russian news agencies revealed a serious cyber incident in the Mediterranean Sea, during which the liquefied natural gas (LNG) carrier “VIVIT AFRICA LNG” (IMO 9950105), owned by Vitol and operated by H-Line Shipping, was targeted by a cyberattack. The vessel, with a capacity of 174,000 cubic metres, was transporting its cargo from the Cameron LNG terminal in Lake Charles, USA, to the Adriatic LNG terminal in the northern Adriatic Sea (with a capacity of 7.5 million tonnes per year). The vessel's route took it through the Strait of Gibraltar (on September 2) into the Mediterranean, and it was scheduled to arrive at its destination on September 7, but it suddenly veered off course and stopped some distance from the dock. The unusual movement pattern, along with the presence of a search and rescue aircraft nearby, indicated that the engines were still running, but the vessel was neither in normal standby mode nor at anchor. The news source stated that shortly before, a cyberattack had disrupted all navigation, communications, and cargo operation systems, and that the charterer (Vitol) and the shipowner, H-Line Shipping, had attempted to conceal the incident from the media.

It is worth noting that the vessel had also experienced an interruption while loading at the Cameron LNG terminal (with a nominal capacity of 13.5 million tonnes and an operating capacity of nearly 15 million tonnes per year); the thermal fuse of the passive fire protection system and the emergency shutdown (ESD) system were activated, halting loading operations. Although no actual fire broke out, loading resumed at a rate of 8,000 cubic metres per hour. The cargo control system report for that same day recorded a series of warnings and emergency alarms, which could indicate that cyber attackers had been monitoring operations from the loading point at US ports.

This incident has occurred at the most critical possible moment. In recent years, the European Union has shifted heavily toward US LNG as a substitute for Russian gas, and by 2025 the US share of European LNG imports reached 28% (a 61% increase, equivalent to 63.8 million tonnes). In 2026, with the continuation of a cold winter and the crisis in the Strait of Hormuz, this dependence has only grown. However, the recent incident has demonstrated that US supplies cannot be relied upon entirely, especially in the face of cyber risks. The immediate impact was felt in the European market: the European Gas Infrastructure Association (GIE) announced that the Adriatic LNG terminal had reduced its unloading capacity due to an unforeseen technical issue with the vessel, amounting to approximately 8% of the terminal's capacity. The moment is extremely delicate, as gas prices in Europe have approached $1,000 per thousand cubic metres, and underground storage facilities are only 67.12% full, while the goal is to reach 75% before the start of the extraction season, with less than a month remaining to achieve it.

Previously, concerns were mainly limited to disruptions in positioning, the sending of false signals, or GPS jamming. However, since 2023, evidence has emerged of ransomware incapacitating vessels. A DNV security officer recounted an incident in which ransomware stopped a ship, forcing them to perform an emergency recovery. Kaspersky expert V. Dashchenko had warned that maritime cybersecurity is an emerging phenomenon and that, if not taken seriously, it could sweep across the entire sector like a devastating wave. This incident serves as a stark wake-up call for Europe's energy security and the reliability of US LNG exports.