On May 7, 2021, Colonial Pipeline, an American oil pipeline system that originates in Houston, Texas, and carries gasoline and jet fuel mainly to the Southeastern United States, suffered a ransomware cyberattack that afflicted computerized equipment managing the pipeline. The Colonial Pipeline Company halted all pipeline operations to contain the attack. Overseen by the FBI, the company paid the amount that was asked by the hacker group (75 bitcoin or $4.4 million USD) within several hours; upon receipt of the ransom, an IT tool was provided to the Colonial Pipeline Company by DarkSide to restore the system. However, the tool required a very long processing time to restore the system to a working state.
The Federal Motor Carrier Safety Administration issued a regional emergency declaration for 17 states and Washington, D.C., to keep fuel supply lines open on May 9. It was the largest cyberattack on an oil infrastructure target in the history of the United States. The FBI and various media sources identified the criminal hacking group DarkSide as the responsible party. The same group is believed to have stolen 100 gigabytes of data from the company servers the day before the malware attack.
On June 7, the Department of Justice announced that it had recovered 63.7 of the bitcoins (about 84% of the original payment) from the ransom payment, but due to a crash in the value of Bitcoin in late May, the recovered bitcoins were worth only around $2.3 million USD, roughly half of their original value.
This was one of the first high profile corporate cyber attacks which started from a breached employee personal password likely found on the dark web rather than a direct attack on the company's systems.
Background
The pipeline network operated by Colonial Pipeline carries gasoline, diesel, and jet fuel from Texas to New York. About 45% of all fuel consumed on the East Coast arrives via the pipeline system. The attack occurred amid rising concerns about the vulnerability of critical infrastructure to cyberattacks, following several high-profile incidents, such as the 2020 SolarWinds hack, which affected multiple U.S. federal government agencies, including the Departments of Defense, Treasury, State, and Homeland Security.
Attack
The attackers gained access to the system using a compromised password for an inactive virtual private network (VPN) account, which did not have multi-factor authentication enabled.
Consequences
The attack primarily targeted the company's billing infrastructure. However, the oil pumping systems remained operational. According to CNN sources within the company, the inability to bill customers was cited as the reason for halting pipeline operations. Colonial Pipeline reported shutting down the pipeline as a precaution, citing concerns that hackers might have accessed information enabling further attacks on vulnerable infrastructure. The day after the attack, Colonial Pipeline stated it could not confirm when the pipeline would resume normal operations. The attackers stole nearly 100 gigabytes of data and threatened to release it online if the ransom was not paid. Reports indicated that within hours of the attack, the company paid a ransom of nearly 75 Bitcoins ($4.4 million USD) in exchange for a decryption tool. However, the tool was reportedly slow, and the company's business continuity measures proved more effective in restoring operations.
On May 9, Colonial stated they planned to substantially repair and restore the pipeline's operations by the end of the week.
In response to fuel shortages at Charlotte Douglas International Airport following the pipeline shutdown, American Airlines temporarily adjusted its flight schedules. At least two flights, to Honolulu and London, required additional fuel stops or plane changes over a four-day period. The shortage also led Hartsfield–Jackson Atlanta International Airport to rely on alternative fuel suppliers. At least five other airports were also directly affected by the pipeline shutdown.
Fuel shortages emerged at filling stations, exacerbated by panic buying, as the pipeline shutdown entered its fourth day. Fuel shortages were reported in Alabama, Florida, Georgia, North Carolina, and South Carolina. The most affected areas ranged from northern South Carolina to southern Virginia. In Charlotte, 71% of filling stations were out of fuel by May 11, while in Washington D.C., 87% of stations had run out by May 14. Average fuel prices rose to their highest level since 2014, exceeding $3 per gallon.
Experts have stated that the attacks were preventable but that essential protective measures were not in place. Although the East Coast gasoline shortage and DarkSide's receipt of the ransom had significant consequences, they were not the most critical implications of the incident. The broader concern was the cybersecurity vulnerabilities and their potential impact on critical infrastructure in the United States.
Responses
U.S. President Joe Biden declared a state of emergency on May 9, 2021. During regular times there were limits on the amount of petroleum products that could be transported by road, rail, etc., domestically within the U.S. mainland. However, with the declaration in place, these were temporarily suspended.
On May 10, Georgia Governor Brian Kemp declared a state of emergency, and temporarily waived collection of the state's taxes on motor fuels (diesel and gasoline). In response to panic buying in the Southeast, U.S. Transportation Secretary Pete Buttigieg and U.S. Energy Secretary Jennifer Granholm on May 12 both cautioned against gasoline hoarding, reiterating that the United States was undergoing a "supply crunch" rather than a gas shortage.
On May 12, the U.S. Consumer Product Safety Commission advised people to "not fill plastic bags with gasoline" or to use any containers not meant for fuel.
Biden signed Executive Order 14028 on May 12, increasing software security standards for sales to the government, tighten detection and security on existing systems, improve information sharing and training, establish a Cyber Safety Review Board, and improve incident response. The United States Department of Justice also convened a cybersecurity task force to increase prosecutions.
On May 27, 2021, the Transportation Security Administration (TSA) announced a security directive for owners and operators of critical pipelines. It required them to report cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency (CISA), to name a cybersecurity coordinator available around the clock, and to review their practices and report their findings to TSA and CISA within 30 days. In announcing the directive, Secretary of Homeland Security Alejandro Mayorkas referred to "the recent ransomware attack on a major petroleum pipeline".
The Department of State issued a statement that a $10,000,000 reward would be given out in case of information leading to the arrest of DarkSide members.
In May 2022, the Pipeline and Hazardous Materials Safety Administration (PHMSA), part of the U.S. Department of Transportation, proposed a $986,400 penalty against Colonial Pipeline for violations of federal safety regulations. The proposal followed a PHMSA inspection of the company's control room management procedures carried out between January and November 2020. According to the regulator, Colonial had probably not planned and prepared adequately for shutting down and restarting the pipeline manually, and this contributed to the nationwide effects of the outage after the attack. Colonial described the notice as the first step in a multi-step regulatory process. In September 2023, PHMSA issued a consent order settling the case, under which Colonial agreed to pay a reduced civil penalty of $948,400. Without admitting or denying the allegations, the company accepted the findings of violation for the purposes of the settlement. PHMSA also stated in the agreement that it was not alleging that Colonial had caused the cyberattack.
Perpetrators
DarkSide released a statement on May 9 that did not directly mention the attack, but claimed that "our goal is to make money, and not creating problems for society."
Pipeline restart
The restart of pipeline operations began at 5 p.m. on May 12, ending a six-day shutdown, although Colonial Pipeline Company warned that it could take several more days for service to return to normal. The pipeline company stated that several markets that are served by the pipeline may experience, or continue to experience, intermittent service interruptions during the restart. The company also stated that they would move as much gasoline, diesel and jet fuel as safely possible until markets return to normal. All Colonial Pipeline systems and operations had returned to normal by May 15. After the shutdown, the average national price of gasoline rose to the highest it had been in over six years, to about an average of US$3.04 a gallon on May 18. The price increase was more pronounced in the southern states, with prices rising between 9 and 16 cents in the Carolinas, Tennessee, Virginia, and Georgia. Around 10,600 gas stations were still without gas as of May 18.
In a May 19, 2021, interview with The Wall Street Journal, Joseph Blount said why he ultimately decided to pay a $4.4 million ransom to hackers who breached the company's systems; "It was the right thing to do for the country." He also said, "I know that's a highly controversial decision".
Investigations
Biden said on May 10 that though there was no evidence that the Russian government was responsible for the attack, there was evidence that the DarkSide group is in Russia, and that thus, Russian authorities "have some responsibility to deal with this". Independent cybersecurity researchers have also stated the hacking group is Russian as their malware avoids encrypting files in a system where the language is set to Russian.
In the aftermath of the attack, it was revealed at a Senate Armed Services cyber subcommittee hearing that the Department of Homeland Security was not alerted to the ransomware attack and that the Justice Department was not alerted to the ransom type or amount, prompting discussion about the numerous information silos in the government and difficulties of sharing.
Blockchain analytics firm Elliptic published a bitcoin wallet report showing $90 million in bitcoin ransom payments were made to DarkSide or DarkSide affiliates over the last year, originating from 47 distinct wallets. According to a DarkTracer release of 2226 victim organizations since May 2019, 99 organizations have been infected with the DarkSide malware – suggesting that approximately 47% of victims paid a ransom and that the average payment was $1.9 million. The DarkSide developer had received bitcoins worth $15.5 million (17%), with the remaining $74.7 million (83%) going to the various affiliates.
Partial ransom recovery
The U.S. Department of Justice issued a press release on June 7, 2021, stating that it had seized 63.7 Bitcoins from the original ransom payment. The value of the recovered Bitcoins was only $2.3 million, because the trading price of Bitcoin had fallen since the date of the ransom payment. Through possession of the private key of the ransom account, the FBI was able to retrieve the Bitcoin, though it did not disclose how it obtained the private key.