Colonial Pipeline, which supplies almost half of the fuel used on the US East Coast, shut its network on 7 May 2021 after a ransomware attack. What is known as of 10 May and what a business can learn.
On Friday 7 May 2021, Colonial Pipeline Company, based in Alpharetta, Georgia, learned that it had been the victim of a cyberattack, determined that it involved ransomware —software that locks a company’s files and demands a payment to release them— and, as a precaution, shut down its entire pipeline. It is regarded as the largest fuel pipeline in the United States: more than 8,850 kilometres from the Gulf Coast refineries in Texas to New Jersey, carrying petrol, diesel, jet fuel and heating oil. According to the company itself, it supplies close to 45% of the fuel consumed on the East Coast. By Monday 10 May the pipeline had been shut for three days.
What is known
On Saturday 8 May Colonial explained that it had taken certain systems offline to contain the threat, which temporarily halted all pipeline operations and affected some of its IT systems. It hired an outside cybersecurity firm and notified law enforcement and several federal agencies. According to published reports, the damage was confined to the company’s computer network and the pipeline itself was not damaged. On Sunday 9 May it said it was drawing up a restart plan: the main lines were still shut, although some smaller lines were running. On Monday 10 May it spoke of a phased restart, aiming to recover much of its activity by the end of the week, and repeated that it would restore full service only when it judged it safe to do so.
That same Monday, the FBI confirmed that the attack was the work of DarkSide, a group active since August 2020 that operates as “ransomware as a service”: it supplies its software to other criminals in exchange for a share of what they collect. According to a person close to the investigation quoted by the AP news agency, the attackers also appear to have stolen data. Colonial has not said whether it received a ransom demand or whether it has negotiated or paid.
The response and the effect on supply
The Department of Energy is leading the federal response. On Sunday 9 May the Department of Transportation declared a regional emergency relaxing drivers’ hours rules for lorry drivers carrying fuel in 17 states and Washington, D.C., to make road deliveries easier, and on Monday the Defense Logistics Agency said its stocks were enough to supply its customers. Analysts consulted by the US press expected little change in prices if service resumed within a few days. If the shutdown lasted between one and three weeks, the consultancy IHS Markit estimated that petrol could become 15 to 20 cents a gallon more expensive over the following week or two.
What to review
The case shows that an attack on a company’s computers can halt its physical operations even when the machinery is undamaged: the decision to disconnect was the company’s own, to stop the problem spreading. For any business, the useful question is which processes depend on which IT systems, and what would happen if they had to be switched off for several days.
Among the usual practices, it is worth checking that there are backups disconnected from the network and that restoring them has been tested; that the office network is separated from production systems; that remote access uses two-factor authentication; and that there is a written incident response plan, with a cybersecurity provider to call, someone who decides when to stop and restart, and a settled position on a ransom demand, which the authorities usually advise against paying.
In Spain, operators of essential services in strategic sectors such as energy are subject to Royal Decree-Law 12/2018, which requires them to adopt security measures and to notify incidents that could significantly affect their service to the competent authority through the reference CSIRT. In December 2020 the European Commission proposed revising the EU directive (known as NIS2), with more sectors and more demands on medium-sized and large companies. Ask your IT security lead whether your business would fall within its scope.
A cyberattack is no longer a problem for the IT department: it can decide whether a company keeps operating.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
