HSI Rescues 19 Women From Gulf Cargo Ship — Vessel Trafficking Ring EXPOSED

5:22 a.m. May 17th, 2026.  Gulf of Mexico, 40 nautical miles southwest of Galveston, Texas. Three US Coast Guard vessels cut their running lights and held position in the pre-dawn chop. Aboard the cutter USCGCS Steadfast, a boarding team of 11 federal agents and Coast Guard law enforcement personnel checked their equipment in silence.

The target vessel, a 187-m Panamanian-flagged general cargo ship called the MV Estrella Dorada, sat low in the water two nautical miles ahead, running at reduced speed on a course toward Galveston Anchorage. The Estrella Dorada had been under active surveillance for 9 weeks. What was about to happen started not with a wiretap, not with a confidential informant, not with a tip from a foreign intelligence partner.

It started with a single number that didn’t match another number. A discrepancy so small that two automated screening systems had already dismissed it as a data entry error. 19 women were on that ship. They had been there for 11 days. The number that didn’t match belonged to a contract risk analyst named Elena Vasquez.

She worked out of a nondescript office building in Springfield, Virginia. The kind of building with a badge reader at every door and no exterior signage. The building housed a unit called the National Targeting Center, a joint DHS-CBP operation that runs around the clock processing cargo and vessel data from every US port of entry.

Vasquez had been working at NTC for 6 years. Her job was vessel risk scoring, cross-referencing automatic identification system tracking data, cargo manifests, crew declarations, and CBP biometric entry logs to flag anomalies for further review. Most of what she flagged turned out to be paperwork errors. Transposed digits in a crew member’s passport number.

A manifest filed in the wrong port sequence. Clerical problems. On the morning of March 3rd, 2026, Vasquez was running a routine audit of Gulf Coast vessel traffic from the previous 90 days when she pulled the file on the MV Estrella Dorada. The ship’s declared route was straightforward. Agricultural commodity hauler registered in Panama operated by a Latvian shipping management company Vestmar Logistics Group.

The Estrella Dorada had been moving soybean meal and sunflower oil between South American ports and US Gulf Coast terminals since 2021. Clean compliance history. No prior enforcement actions. 12 permanent crew members listed on every manifest filing. Vasquez wasn’t looking at the Estrella Dorada specifically.

She was running a batch audit of vessels that had made four or more US port calls in a 90-day window looking for scheduling irregularities that might indicate non-declared cargo activity. The Estrella Dorada had made six port calls in 89 days. New Orleans on February 6th, Corpus Christi on February 14th, Mobile on February 22nd, Tampa on March 1st, Corpus Christi again on March 8th, and a scheduled arrival in New Orleans on March 15th.

Six stops in 89 days for an agricultural hauler was high but not unusual during peak commodity season. What caught Vasquez’s attention was a column in her spreadsheet she had built herself. A comparison field she had added to her personal audit template after noticing similar discrepancies in a different vessel case 2 years earlier.

The column compared declared crew count on each manifest against CBP biometric log entries for each port call. The Estrella Dorada consistently declared 12 crew members. CBP biometric logs showed between 17 and 23 individuals boarding or disembarking at each stop. The gap ranged from five to 11 people per port call.

Over six port calls, that meant somewhere between 30 and 66 undeclared biometric interactions associated with the vessel. Vasquez flagged the file and submitted it through NTC’s standard escalation queue at 9:14 a.m. on March 3rd. The queue routed the flag to a senior analyst for preliminary review. It came back marked resolved.

Data discrepancy. On March 4th, with a note indicating the variation was consistent with short-term contract crew rotation and did not meet the threshold for formal referral. Vasquez looked at the resolution note. She looked at the data again. Short-term contract crew rotation would explain one or two additional biometric entries per port call.

It would not explain a consistent gap of five to 11 individuals across every single stop with no corresponding amendment to any crew manifest. She resubmitted the flag on March 5th. This time, appending a two-page supplemental analysis she had written herself laying out the mathematical improbability of the discrepancy being explained by routine crew rotation without any manifest amendments.

The supplemental noted that in four of the six port calls, the biometric gap was on the high end, 19 to 23 individuals, which exceeded the vessel’s declared crew count by nearly double. The second flag came back marked resolved on March 6th. Same notation. Vasquez escalated outside the standard queue. She contacted a supervisory agent she knew at HSI, Homeland Security Investigations, through an interagency coordination channel and sent him the file directly.

His name was David Okafor. He had spent 11 years working maritime trafficking cases out of HSI’s Houston field office. Okafor read the file on the evening of March 6th. He opened a formal vessel intelligence case by March 8th. I spent time going through the case documentation on this one, and one detail kept coming back.

 The automated screening system had flagged the Estrella Dorada’s biometric discrepancy during the February 6th New Orleans port call, and cleared it in under 4 minutes. The system was tuned to minimize false positives in high volume periods. In a busy Gulf Coast port processing dozens of vessels a day, a five-person biometric gap on an agricultural hauler didn’t look like a crisis.

It looked like a rounding error. Vazquez saw it differently because she was looking at all six stops simultaneously, not one at a time. That’s the thing about pattern recognition. A single data point is noise. Six data points in sequence is a signal. The algorithm was built to catch the former. A human analyst caught the latter.

HSI’s Houston field office assigned two senior agents to the vessel intelligence file on March 9th. Special Agent Marcus Webb and Special Agent Renata Flores. Their first step was a full records pull on Vestmar Logistics Group, the Latvian company that managed the Estrella Dorada. Vestmar had been in operation since 2018.

On paper, it was a legitimate mid-size shipping management company with a portfolio of seven vessels operating primarily in Atlantic and Gulf Coast commodity routes. Its registered address was in Riga. Its corporate filings were current. It had no prior enforcement history with US agencies. Web ran Vestmar through HSI’s international financial intelligence feeds.

Clean. Floris queried Europol’s maritime intelligence database. That query came back with something that changed the scope of the investigation within 24 hours. Europol’s human trafficking unit, specifically its joint investigation team on maritime smuggling, which operated out of The Hague, had an active file on the MV Estrella Dorada dating back to October 2025.

The file documented suspected use of the vessel in human trafficking operations along Mediterranean routes, specifically between North African ports and Southern European coastal entry points. Europol’s file identified the Estrella Dorada as a vessel of interest, but had been unable to develop sufficient evidence for interdiction under European maritime jurisdiction.

The file also contained something else. Intelligence from a cooperating source within the maritime labor recruitment sector in Eastern Europe indicated that Vestmar Logistics Group had been recruiting women from Ukraine, Moldova, and Romania using falsified maritime employment contracts that promised hospitality and food service work in Gulf Coast cities, primarily Houston and New Orleans.

The contracts specified wages, accommodation, and legal work authorization. None of it was real. HSI Houston sent a formal liaison request to Europol’s JIT on March 11th. Europol responded the same day. What’s most surprising about this case isn’t the scale of the trafficking network, it’s the mechanism.

 This wasn’t a criminal organization that built a trafficking operation from scratch and then acquired a ship to run it. This was a legitimate shipping company by all documented evidence, a real agricultural hauler with real cargo contracts and real commodity clients that had been converted into a dual-use trafficking platform.

The cargo was real. The crew was real. The Estrella Dorada was moving actual soybean meal on legitimate commodity contracts. The trafficking operation was running underneath it, literally and structurally, in a modified birthing compartment that didn’t appear on any official ship schematic. The operation had a cover story that was almost entirely true.

That’s what made it hard to see. The 9-week investigation that followed involved HSI Houston, the US Coast Guard Investigative Service, Europol’s JIT, and after March 20th, a Latvian law enforcement liaison attached through a mutual legal assistance request. Coordination ran through a joint operations cell established at HSI Houston’s field office on Commerce Street.

The core investigative challenge was easy to define and hard to solve. Agents needed to confirm that the Estrella Dorada was actively carrying undeclared individuals before they could intercept it, and they needed to do that without tipping off the vessel’s operators that a federal investigation was active. The vessel was not scheduled to enter US waters again until early May.

 It had departed Tampa on March 9th, two days before HSI opened the formal file, and was tracked by AIS moving towards South American ports, Barranquilla, Colombia, then Montevideo, Uruguay. Europol confirmed via their cooperating source that the next northbound transit was expected in late April or early May with a destination of Galveston, Texas.

That gave the joint operations cell approximately 7 weeks to build the case and prepare the interdiction. The first obstacle came in week two. Webb and Flores attempted to pull complete CBP biometric records for all six of the Estrella Dorada’s recent US port calls. Not just the summary counts that appeared in the NTC audit data, but the full biometric entry files with timestamps, biometric identifiers, and any associated documentation.

The request went through CBP’s data access protocol and came back partially redacted. Three of the six port calls had complete records. Three, including the two Corpus Christi stops and the Mobile stop, had records  flagged as incomplete due to a system migration that had occurred in January 2026, during which approximately 18 days of Gulf Coast CBP biometric data had been improperly archived.

The missing records covered exactly the period when the Estrella Dorada’s biometric discrepancy had been largest. Webb and Flores spent 4 days working through CBP’s Office of Field Operations to reconstruct the incomplete records from backup systems. The reconstruction was partial. They recovered enough data to document the discrepancy pattern across four of the six port calls, which was sufficient for the formal case file, but left gaps that defense attorneys would later attempt to exploit.

The second obstacle was Vestmar Logistics Group’s corporate structure. When HSI and Latvian liaison agents began tracing Vestmar’s ownership through corporate registry records in Latvia, Estonia, and Cyprus, they found a layered structure involving three holding companies, two of which were registered in jurisdictions with limited beneficial ownership disclosure requirements.

The actual controlling interest in Vestmar resolved, after 3 weeks of financial forensics, to a 61-year-old Latvian national named Andris Kalnins, who had no prior criminal record and presented publicly as a retired maritime logistics consultant. Kalnins was not aboard the Estrella Dorada. His role in the trafficking operation, and whether he would ever face charges, remained an open question through the entire investigation.

The case against the vessel’s command crew, the captain and his two senior officers, was built differently. Europol’s cooperating source provided testimony indicating that the captain, a 54-year-old Croatian national named Tomislav Juric, was directly aware of and compensated for the undeclared passengers. Juric had commanded the Estrella Dorada since 2022.

 The two officers named as co-conspirators were a Lithuanian chief officer named Erikas Tomašauskas and a Ukrainian second officer named Bohdan Marchenko. Marchenko was 31 years old. The detail about Marchenko stayed with investigators. Here was a Ukrainian national in March 2026 working as a licensed maritime officer on a vessel being used to traffic women out of Ukraine and Moldova under false employment contracts.

Whether Marchenko understood the full scope of what the ship was being used for, whether he had been recruited into the conspiracy or joined it voluntarily, whether he had ever interacted with the women concealed below decks, none of that was resolved by the investigation. He was present. His name was on the command crew list.

He was charged. Put yourself in Elena Vasquez’s position for a moment. It’s March 5th. You’ve submitted a flag that was dismissed once already. You’ve written a two-page supplemental analysis on your own time. You’re a contract analyst, not a sworn federal agent. You have no authority to compel anyone to take this seriously.

You could have let it go. The system told you twice it wasn’t a problem. The rational institutional move was to mark the file and move on. She didn’t. By mid-April, the joint operations cell had developed enough of a case to move toward interdiction planning. The challenge was timing. The Estrella Dorada’s AIS tracking showed it departing Montevideo on April 19th, northbound on a transit consistent with a Galveston arrival in the second or third week of May.

The vessel’s declared cargo was sunflower oil consigned to a Houston commodity terminal. Europol’s cooperating source made contact again  on April 23rd. The source indicated that a group of women, the source said around 20, had been transported to a port in Columbia, specifically Cartagena, in early April, and had been brought aboard the Estrella Dorada during a brief stop on April 21st.

The women were traveling on falsified Honduran maritime employment documents. The cover story, according to the source, was that they were kitchen and hospitality staff being transferred to a catering contractor in Houston. The source’s information placed the women aboard the vessel more than 3 weeks before the planned interdiction.

That meant they were already on the ship in the modified birthing compartment for the entire northbound transit. The Estrella Dorada had no scheduled US port call between Cartagena and Galveston. There was no opportunity for the women to be offloaded or for the trafficking operation to be disrupted before the vessel reached US waters.

The interdiction had to happen at sea, under Coast Guard jurisdiction, under the maritime law enforcement authorities that govern vessel boarding outside US territorial waters. Here’s the part that doesn’t sit right, even now. Three weeks, for at least 3 weeks, 19 women were confined in a below waterline compartment on a working cargo ship in the Gulf of Mexico, and every federal resource available was focused on building a case file and coordinating a boarding operation.

The operational logic was sound. Interdicting the vessel at sea with a prepared boarding team was the safest way to secure the women and preserve the evidence needed for federal prosecution. A premature alert would have given Jurich time to divert the vessel to a non-US port, or, in the worst scenario, to take more drastic measures.

The decision to wait was defensible. It was also a decision to leave 19 people in a compartment below the waterline for 3 more weeks while the paperwork caught up. We’ll say what most won’t. The system that allowed this vessel to make six port calls along the US Gulf Coast, six, while carrying undeclared human cargo, failed these women before Elena Vasquez noticed the discrepancy.

The automated screening that dismissed the biometric gap wasn’t a minor technical issue. It was a structural vulnerability in the port security architecture. The fix isn’t one analyst submitting one flag. The fix is redesigning the system so that the pattern Vasquez identified manually is caught automatically on the first port call, not the sixth.

The Joint Operations Cell confirmed the interdiction window on May 12th. The Estrella Dorada was tracking on a course that would bring it to Galveston Anchorage on the morning of May 17th. Coast Guard Sector Houston-Galveston coordinated with HSI Houston to stage the boarding assets offshore, outside the vessel’s AIS monitoring range, during the overnight hours of May 16th to 17th.

The boarding team composition reflected the hybrid nature of the operation. Four HSI special agents, Webb and Flores among them, were embedded with a seven-member Coast Guard Maritime Law Enforcement Detachment. The team carried federal arrest warrants for Jurich, Tomas Aides, and Marchenko issued by a federal magistrate in the Southern District of Texas on May 14th.

They also carried a vessel boarding and search authority under 14 USC Section 522,  which gives the Coast Guard authority to board any vessel subject to US jurisdiction on the high seas. The third obstacle came at 4:47 a.m. on May 17th, 40 minutes before the planned boarding. AIS data showed the Estrella Dorada executing a course change, a 17-degree turn to the southwest, away from Galveston.

The vessel’s speed also dropped from 9.4 knots to 6.1 knots. Two possible explanations. The first was routine, a vessel adjusting course for weather, traffic, or anchorage sequencing. The second was that someone aboard the Estrella Dorada had been tipped  off that federal assets were in the area.

 The joint operations cell had 11 minutes to decide whether to proceed with the boarding or stand down and wait for the vessel to resume its original course. Special Agent Webb, coordinating from the operations cell at HSI Houston, made the call at 4:58 a.m. Proceed. The USCG C Steadfast and its two accompanying vessels, a Coast Guard patrol boat and a second cutter carrying backup law enforcement personnel, increased speed and moved to intercept.

The Estrella Dorada was hailed by radio at 5:19 a.m. under standard maritime law enforcement protocol. The vessel was ordered to heave-to and prepare for boarding. After a 90-second delay, longer than standard, the ship’s bridge acknowledged and reduced speed. The boarding team reached the vessel’s boarding ladder at 5:31 a.m.

What they found in the first 30 minutes matched the worst-case scenario that had been planned for and hoped against. The Estrella Dorada’s official crew of 12 was present and accounted for on the main deck and bridge. The vessel’s manifest was in order. The cargo hold contained what the manifest described, sunflower oil in sealed flexitanks, properly secured.

The bridge logbook was current and signed. On initial inspection, the vessel appeared compliant. The HSI agents had the modified birthing compartment coordinates from Europol’s technical analysis of the vessel’s original construction schematics versus its current configuration. A 3-year-old analysis based on satellite imagery and a cooperating source who had been aboard the vessel in 2023.

The analysis identified a probable modified space in the after lower decks below the waterline in an area that appeared on the official schematics as ballast tank access and void space. Web led the team to the after lower deck access hatch at 5:44 a.m. The hatch was secured with a padlock that was not on the vessel’s equipment inventory.

One of the Coast Guard law enforcement personnel cut it with a bolt cutter. The space behind the hatch was approximately 14 m long and 4 m wide. It had been modified with pipe frame bunk structures bolted to the hull plating. Four tiers, eight bunks per tier on each side. The ventilation was a single industrial fan ducted to a void space in the adjacent ballast tank system.

There was a chemical toilet at the far end. There were water containers and packaged food stores stacked near the entrance. 19 women were in the compartment. They ranged in age, investigators would later determine, from 19 to 34 years old. 11 were from Ukraine. Six were from Nigeria and Cameroon. Two were from Moldova.

All 19 were alive. Several required medical attention. Dehydration, respiratory symptoms consistent with poor ventilation over an extended period. One case of a possible fracture from a fall in heavy seas during the transit. None of them spoke to federal agents immediately. According to the after action documentation, they were initially unresponsive, not in a medical sense, but behaviorally.

They sat or stood in the compartment and did not move toward the hatch when it was opened. The HSI agents had a Ukrainian-speaking interpreter available via secure satellite link. The interpreter spoke to the women for approximately 4 minutes before any of them responded. The first thing any of them said, according to the interpreter, was a question about whether they were going to be arrested.

Jurich, Tomasaitis,    and Marchenko were placed under arrest on the bridge of the Estrella Dorada at 6:11 a.m. Jurich said nothing when he was formally advised of his arrest. Tomasaitis asked for a lawyer. Marchenko, the 31-year-old Ukrainian second officer, sat down on the bridge deck and put his face in his hands.

The Estrella Dorada was seized as evidence and escorted to Galveston by the Coast Guard flotilla. It arrived at the federal inspection pier at 11:43 a.m. on May 17th, 2026. The 19 women were transported to a secure HSI processing facility in Houston. They were provided medical evaluation, food, clothing, and access to consular services.

 HSI victim services personnel and NGO partners specializing in trafficking survivor support were on site within 2 hours of the vessel’s arrival. The federal indictment against Jurich, Tomasaitis, and Marchenko, filed in the Southern District of Texas on May 22nd, charged all three with forced labor trafficking, alien harboring for financial gain, and conspiracy to commit human trafficking.

Jurich faced an additional charge of making false statements to federal officers based on his response to the boarding team’s initial vessel inspection. The indictment alleged that the trafficking corridor had been operational since at least early 2023, and that the Estrella Dorada had moved over 200 individuals through US Gulf Coast ports during that period.

The 200 figure was an investigative estimate. The actual number has not been confirmed. It may be higher. Latvian law enforcement, working under the mutual legal assistance request filed in March, executed search warrants on Vestmar Logistics Group’s Riga offices on May 19th, 2 days after the Gulf interdiction.

They seized corporate records, financial documents, and digital storage devices. Andris Kalniņš, the identified beneficial owner of Vestmar, was detained for questioning on May 20th. As of the filing of the federal indictment, Kalniņš had not been charged. His extradition status, and whether the US government would seek his prosecution, remained unresolved.

 The women who were transported to Houston under false employment contracts signed documents they understood to be work authorization papers. The actual documents they signed, investigators determined, included consent to transport clauses buried in contract language that had been machine translated from Latvian into Ukrainian and English with deliberate mistranslation of key terms.

The women believed they were signing employment agreements. They were signing documents that purported to authorize their transport as maritime service personnel. A legal fiction the trafficking network had apparently used to explain undeclared passenger presence to any port authority that might question it.

None of the documentation held up under legal scrutiny. It was not designed to. It was designed to create enough paperwork ambiguity to slow any investigation that didn’t have direct access to the women themselves. The commodity contracts that gave the Estrella Dorada its cover, the legitimate agricultural hauling business, remained active through the investigation.

As of May 22nd, the vessel’s cargo clients had not been notified that the ship they had been contracting for commodity transport had been seized by federal authorities. The clients were European and South American agricultural trading companies. There is no indication they were aware of the vessel’s secondary function.

The Estrella Dorada is currently at the Galveston federal inspection pier awaiting judicial disposition. The vessel is valued at at $14 million. The six calls it made along the US Gulf Coast between early February and early March 2026, New Orleans, Corpus Christi, Mobile, Tampa, Corpus Christi again, and the final inbound transit that ended at sea, represent known operational activity.

What the vessel was doing before October 2025, and how many port calls it may have made in prior years under different route configurations, is still being determined. Europol’s JIT has identified three additional vessels associated with Vestmar Logistics Group’s broader network that are currently under surveillance.

None of those vessels have been interdicted. Their routes, and whether they are being used for the same purpose as the Estrella Dorada, is an open investigative question. The trafficking corridor the Estrella Dorada serviced ran from Eastern European recruitment zones, primarily Western Ukraine, Northern Moldova, and Southern Romania, through intermediary logistics hubs in Colombia and Panama, and into US Gulf Coast ports.

The corridor used the legitimate maritime labor recruitment sector as its recruitment channel. Women seeking work abroad were identified through labor placement agencies in their home cities, contacted with job offers that specified Gulf Coast hospitality employment, and funneled into a documentation pipeline that ended with falsified maritime employment contracts issued through Vestmar or affiliated entities.

 The entire process, from initial recruitment contact to departure from a South American port, reportedly took between six and 12 weeks per cohort. HSI estimates the criminal proceeds generated by the trafficking operation, based on documented transit fees and contract values recovered from the Vestmar records seized in Riga, at a minimum of $4.

2 million over the period covered by the indictment. The actual financial scope of the network, including proceeds from prior years and from associated trafficking activities not yet documented, has not been calculated. What do you think? Did the system fail these women? Or was this the result of a network sophisticated enough that the system could only catch it one way, through one analyst looking at the right numbers at the right time? Drop your answer in the comments.

The case against Jurich, Tomas Scheidtus, and Marchenko is proceeding through the Southern District of Texas Federal Court. Jurich faces a maximum sentence of life imprisonment under federal forced labor trafficking statutes. Tomas Scheidtus and Marchenko face sentences of up to 20 years. The sentencing hearings have not been scheduled.

Elena Vasquez’s supplemental analysis, the two-page document she wrote on her own time after her first flag was dismissed, has been formally incorporated into NTC’s internal case documentation    as a reference example for biometric cross-referencing methodology. DHS’s Office of Intelligence and Analysis cited the Estrella Dorada case in an internal guidance memorandum issued in June 2026, recommending that NTC update its automated screening protocols to flag cumulative biometric discrepancies across multiple port calls rather than

evaluating each port call in isolation. The protocol update is listed as pending implementation. No implementation date has been set. One of the things that doesn’t resolve cleanly in this case is the question of what happened to the women at the prior port calls. Not the 19 recovered on May 17th, but the individuals whose biometric entries appeared in the NTC data across the Estrella Dorada six port calls between February and March 2026.

The aggregate discrepancy across those six calls suggested between 30 and 66 undeclared biometric interactions. 19 women were recovered from the vessel on May 17th. The gap between those numbers, the people who passed through those ports and were not recovered, whose identities and current locations are unknown, has not been closed.

HSI has not confirmed how many individuals were moved through Gulf Coast ports in the operation prior to the May 17th interdiction, or what happened to them after they left the vessel. Those individuals are, by definition, the harder to find part of a trafficking case. They are somewhere inside the United States or outside it.

 They may be in labor or sex trafficking situations. They may have found their way to safety. They may not know that the network that brought them here has been dismantled. The network is dismantled. The demand that created it is unchanged. The corridor that served the Gulf Coast for at least 3 years ran because there was a market for what it was moving, and that market existed independently of any single vessel or shipping company or Latvian logistics executive.

The Estrella Dorada is tied to a federal pier in Galveston. The conditions that put it in operation are still in place. If you want to follow what happens next with Jurcis’ trial and the ongoing Europol investigation into the associated vessels, subscribe now. These cases take months to resolve in court, and the Vestmar network story isn’t over.