Outflow of oil from a damaged tanker of "segregated ballast" type having some tanks dedicated for carriage of oil (C) and others (B) for water ballast is minimized by transferring oil out of the upper part of any damaged tank and minimizing the reduction of draft at the damaged area. This is accomplished by installing sluice valves (30) and piping to connect each cargo tank (C) to one or more ballast tanks (B) and providing controls therefor which, in case there is leakage from a cargo tank, are operative to open appropriate valves to allow oil to flow from the upper part of the damaged cargo tank to one or more ballast tanks, which would be empty.