Major Eastern U.S. Pipeline Resumes Operations After Ransomware Attack

UPDATE 5/12/21

• Colonial Pipeline announced that pipeline operations resumed Thursday at 5pm.
• The company noted that "it will take several days for the product delivery supply chain to return to normal." It added:

"Some markets served by Colonial Pipeline may experience, or continue to experience, intermittent service interruptions during the start-up period. Colonial will move as much gasoline, diesel, and jet fuel as is safely possible and will continue to do so until markets return to normal."

• The pipeline's restart comes as GasBuddy reported rising levels of gasoline supply shortages at filling stations across the Eastern and Southern U.S.

What’s the story?

• The Federal Bureau of Investigation (FBI) on Monday confirmed that the Darkside ransomware is responsible for the cyberattack that prompted the shutdown of a major energy pipeline in the Eastern and Southern U.S. Like many other ransomware groups, Darkside has typically spared Russian, Kazakh, and Ukrainian companies, according to a report by Reuters. 
• The Colonial Pipeline Company was targeted by a ransomware attack late last week in its administrative computer systems and temporarily halted pipeline operations in response, although operational systems were not targeted according to reports. Since then, it has been working with law enforcement, federal agencies, and cybersecurity firms in an effort to restore service.
• The 5,500-mile pipeline runs from Texas through Louisiana, Mississippi, Alabama, Georgia, Tennessee, South Carolina, North Carolina, Virginia, and Maryland, to its terminus in New Jersey. The Colonial Pipeline supplies about 45% of the gasoline, heating oil, and jet fuel used on the East Coast.
• In an update, Colonial announced that it is restoring service in a phased and stepwise approach based on safety and compliance standards in the hope of “substantially restoring operational service by the end of the week.” 
• A ransomware attack effectively holds a computer system or sensitive data hostage until the attackers are paid a ransom. The ransom demand in the Colonial Pipeline cyberattack hasn’t been disclosed, although the Darkside group has demanded payments of up to $2 million in previous attacks.

— Eric Revell

(Photo Credit: iStock.com / kodda)