On September 9, 2026, Russian news agencies revealed a serious cyber incident in the Mediterranean Sea, during which the liquefied natural gas (LNG) carrier named "VIVIT AFRICA LNG" (IMO 9950105), owned by Vitol and managed by H‑Line Shipping, was targeted by a cyberattack. The vessel, with a capacity of 174,000 cubic meters, was transporting its cargo from the Cameron LNG terminal in Lake Charles, USA, to the Adriatic LNG terminal in the northern Adriatic Sea (with a capacity of 7.5 million tons per year). The ship's route passed through the Strait of Gibraltar (on September 2) into the Mediterranean and was scheduled to arrive at its destination on September 7, but it suddenly deviated from its course and stopped at a distance from the jetty. The unusual movement pattern, along with the presence of a search‑and‑rescue aircraft nearby, indicated that the engines were still running, but the ship was neither in normal standby mode nor anchored. The news source claimed that shortly beforehand, a cyberattack had disrupted all navigation, communications, and cargo operation systems, and that the charterer (Vitol) and the shipowner, H‑Line Shipping, had attempted to conceal the event from the media.

Notably, the vessel had also experienced a disruption while loading at the Cameron LNG terminal (with a nominal capacity of 13.5 million tons and operational capacity close to 15 million tons per year); the thermal fuse of the passive fire protection system and Emergency Shutdown (ESD) system activated, interrupting loading operations. Although no actual fire occurred, loading resumed at a rate of 8,000 cubic meters per hour. The cargo control system report for that same day recorded a series of warnings and emergency alarms, which could be an indication that the cyber attackers had been monitoring the operations from the point of loading in US ports.

This incident has occurred at the most critical possible time. In recent years, the European Union has heavily pivoted towards US LNG as a replacement for Russian gas, and in 2025, the US share of European LNG imports reached 28% (a 61% increase, amounting to 63.8 million tons). In 2026, with the continuation of a cold winter and the crisis in the Strait of Hormuz, this dependence has only grown. However, the recent incident has demonstrated that US supply cannot be entirely relied upon, especially in the face of cyber risks. The immediate impact was felt in the European market: the European Gas Infrastructure Association (GIE) announced that the Adriatic LNG terminal had reduced its discharge capacity due to an unforeseen technical issue with the vessel, equating to approximately 8% of the terminal's capacity. The timing is highly sensitive, as gas prices in Europe have approached $1,000 per thousand cubic meters, and underground storage facilities are only 67.12% full, while the target is to reach 75% before the start of the withdrawal season—with less than a month remaining to achieve this goal.

Previously, concerns were mostly limited to disruptions in positioning, the sending of false signals, or GPS jamming. However, since 2023, evidence has emerged of ransomware that incapacitates vessels. One security manager at DNV recounted an incident where ransomware stopped a ship, forcing them to perform an emergency recovery. Kaspersky expert V. Dashchenko had warned that the cybersecurity of shipping is an emerging phenomenon, and if not taken seriously, it could sweep across the industry like a devastating wave. This incident serves as a stark wake‑up call for Europe's energy security and the reliability of US LNG export stability.