The operator, Colonial Pipeline, said it had halted systems for its 5,500 miles of pipeline after being hit by a ransomware attack.
One of the nation’s largest pipelines, which carries refined gasoline and jet fuel from Texas up the East Coast to New York, was forced to shut down after being hit by ransomware in a vivid demonstration of the vulnerability of energy infrastructure to cyberattacks.
The operator of the system, Colonial Pipeline, said in a vaguely worded statement late Friday that it had shut down its 5,500 miles of pipeline, which it says carries 45 percent of the East Coast’s fuel supplies, in an effort to contain the breach. Earlier Friday, there were disruptions along the pipeline, but it was not clear at the time whether that was a direct result of the attack or of the company’s moves to proactively halt it.
On Saturday, as the F.B.I., the Energy Department and the White House delved into the details, Colonial Pipeline acknowledged that its corporate computer networks had been hit by a ransomware attack, in which criminal groups hold data hostage until the victim pays a ransom. The company said it had shut the pipeline itself, a precautionary act, apparently for fear that the hackers might have obtained information that would enable them to attack susceptible parts of the pipeline.
Administration officials said they believed the attack was the act of a criminal group, rather than a nation seeking to disrupt critical infrastructure in the United States. But at times, such groups have had loose affiliations with foreign intelligence agencies and have operated on their behalf.
The shutdown of such a vital pipeline, one that has served the East Coast since the early 1960s, highlights the vulnerability of aging infrastructure that has been connected, directly or indirectly, to the internet. In recent months, officials note, the frequency and sophistication of ransomware attacks have soared, crippling victims as varied as the District of Columbia police department, hospitals treating coronavirus patients and manufacturers, which frequently try to hide the attacks out of embarrassment that their systems were pierced.
Colonial, however, had to explain why gasoline and jet fuel were no longer flowing to its customers, and on Friday, the markets began to react as speculation swirled about whether an accident, a maintenance problem or a cyberincident accounted for the shutdown.
But on Saturday, Colonial, which is privately held, declined to say whether it planned to pay the ransom, which frequently suggests that a company is considering doing so, or has already paid. Nor did it say when normal operations would resume.
In the next week or so, the administration is expected to issue a broad-ranging executive order intended to bolster security of federal and private systems after two major attacks from Russia and China in recent months caught American companies and intelligence agencies by surprise.
Colonial’s pipeline transports 2.5 million barrels each day, taking refined gasoline, diesel fuel and jet fuel from the Gulf Coast up to New York Harbor and New York’s major airports. Most of that goes into large storage tanks, and with energy use depressed by the coronavirus pandemic, the attack was unlikely to cause any immediate disruptions.
The company initially said that it had learned on Friday that it “was the victim of a cybersecurity attack,” leading many in the industry and some investigators to believe that the attack might have directly affected the industrial control systems that regulate oil flow. Colonial issued an updated statement on Saturday saying that it had determined that the “incident involves ransomware” and contended that it had taken down its systems as a preventive measure.
“Colonial Pipeline is taking steps to understand and resolve the issue,” the company said. “Our primary focus is the safe and efficient restoration of our service and our efforts to return to normal operation.”
It said it had contacted the law enforcement authorities and other federal agencies. The F.B.I. confirmed that it was involved in the investigation, along with the Energy Department and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency.
Attacks on critical infrastructure have been a major concern for a decade, but they have accelerated in recent months after two breaches — the SolarWinds intrusion by Russia’s main intelligence service, and another against some types of Microsoft-designed systems that has been attributed to Chinese hackers — underscored the vulnerability of the networks on which the government and corporations rely.
Source: https://www.nytimes.com/2021/05/08/us/cyberattack-colonial-pipeline.html
