Colonial Pipeline paid off the Russia-linked hacking group DarkSide to restore access to the key fuel pipeline that was paralyzed in a ransomware attack, according to a new report.
The pipeline operator paid the hackers nearly $5 million in untraceable cryptocurrency, contradicting earlier reports that the company had no intention of meeting the criminal gang’s extortion demands, two people familiar with the transaction told Bloomberg.
The ransom was paid off just hours after the attack commenced last week, the people said, yet the pipeline remained offline for another six days, triggering severe gas shortages, panic buying and chaos across the South.
The decryption key provided by the hackers was so slow the company continued using its own backups to help restore the system, one person said. As well, the 40-year-old pipeline is said to maintain a complex IT infrastructure that includes antiquated systems which have been ‘bolted on top’ of each other over the years.
Though Colonial has begun a system restart, on Thursday morning, 71 percent of gas stations across North Carolina still had no gas, and half of the stations in Florida, Washington DC, Virginia, South Carolina, and Georgia were running dry, according to GasBuddy.
The outages still spread from New Jersey to Mississippi with more than 10,000 gas stations offline, and the national average price of gas rose to $3.028, the highest level since 2014, according to the AAA Gas Price Index.
Colonial has begun to slowly restart the nation’s largest fuel pipeline, but it will take several days for the 5,500 mile pipeline network to return to normal operations, Colonial said, even as motorists in southeastern states jammed stations seeking fuel. A return to ample supplies could take two weeks, analysts said.
Gas travels through the pipeline at just five miles per hour, meaning it will take two weeks to reach New York once flow is restored from the Texas refining hub, according to Bloomberg. Diesel and jet fuel take even longer.
Colonial said in an update on Thursday: ‘By mid-day today, we project that each market we service will be receiving product from our system.’
But GasBuddy analyst Patrick De Haan expects shortages to get worse over the next two days before they get better, tweeting: ‘While the Colonial Pipeline is restarting, the [gas station] outage numbers may drift higher over the next 48 hours before then beginning to fall.’
In an update, Colonial predicted all markets it serves will be receiving gas by noon on Thursday
Motorists line up for gas at one of the few remaining gas stations that still has fuel in Arlington, Virginia, on Thursday. The Colonial Pipeline network has resumed fuel deliveries, but gas stations up and down the east coast were still facing shortages
A note is posted to let motorists know the pumps are empty at a gas station in Arlington, Virginia on Thursday. Widespread station closures have hit the DC area, with half of station in the US capital dry on Thursday morning
In Brooklyn, drivers faced steep prices at an ExxonMobil gas station on Wednesday. The U.S. national average gas prices rose above $3 a gallon on Wednesday for the first time since 2014 amid the shutdown of a major fuel pipeline
The cyberattack halted 2.5 million barrels per day of shipments of gasoline, diesel and jet fuel last Friday after the most disruptive cyberattack ever on U.S. energy infrastructure, causing chaos across the South and spiking gas prices nationwide.
Though Colonial has begun its system restart, relief will not be immediate for millions of frustrated motorists, and the pipeline operator warned of possible ‘intermittent service interruptions during the start-up period.’
Initial reports from Reuters and Washington Post claimed the company did not plan to pay the ransom demanded by hackers who encrypted data on the pipeline.
Both the reports claiming that Colonial refused to pay the hackers and the Bloomberg report saying that they did were based on anonymous sources.
A spokesperson for Colonial did not immediately respond to an inquiry from DailyMail.com on Thursday.
Brett Callow, a threat analyst with Emsisoft, warned that paying off ransomware gangs would only lead to more attacks on critical infrastructure.
‘If Colonial has indeed paid, it unfortunately puts other US critical infrastructure providers even more in the crosshairs than they were before,’ Callow told DailyMail.com on Thursday.
‘Like legit businesses, criminal enterprises do things that have been proven to work and, if infrastructure attacks work, they’ll do more. Rinse and repeat,’ he added.
The FBI has accused a shadowy criminal gang called DarkSide of the ransomware attack. The group, believed to be based in Russia or Eastern Europe, has not directly taken credit, but on Wednesday it claimed to have breached systems at three other companies, including an Illinois tech firm.
Russia’s embassy in the United States vehemently rejected speculation that Moscow was behind the attack. On Monday, Biden stopped short of blaming the Russian government, but said the criminal hacking gang was believed to be based in Russia.
A cybersecurity source tells DailyMail.com that the group scans targets and does not attack them if their systems use the Russian language. Hacker gangs in Russia are believed to operate with the tacit approval of the Russian government, so long as they only target foreign victims.
The Colonial Pipeline is seen above in blue. Gas travels through the pipeline at just five miles per hour, meaning it will take two weeks to make the 1,600-mile journey to New York once flow is restored from the Texas refining hub
Significant parts of the Southeast are heavily dependent on the Colonial Pipeline (seen in blue) for fuel
Motorists wait in line to refuel at a Circle K gas station on Wednesday in Fayetteville, North Carolina. Most stations in the area along I-95 are without fuel following the Colonial Pipeline hack
On Wednesday, President Joe Biden ordered the creation of an air accident-style cyber review board and the imposition of new software standards for government agencies following a spate of digital intrusions that have rattled the United States.
The executive order’s initiatives include the creation of a organization that would investigate major hacks along the lines of National Transportation Safety Board inquiries that are launched after plane crashes. They also include the imposition of new security standards for software bought by government agencies
Colonial said it was working with cybersecurity experts to investigate the attack and had taken additional security measures before beginning the restart.
The company said its control center is handling the restart of the pipeline, which stretches from refineries on the U.S. Gulf Coast to consumers in Mid-Atlantic and Southeast states.
The gas supply crunch sparked panic buying in the U.S. Southeast, bringing long lines and high prices at gas stations ahead of the peak summer driving season.
‘Our top priority right now is getting the fuel to the communities that need it,’ U.S. Transportation Secretary Pete Buttigieg told reporters.
Fuel stocks in the U.S. Northeast will likely hit five-year lows this week as the restart slowly progresses, said S&P Global Platts analyst Richard Joswick. Full recovery ‘will take a couple of weeks at least,’ he added.
A woman fills gas cans at a Speedway gas station on Wednesday in Benson, North Carolina. Most stations in the area along I-95 are without fuel following the Colonial Pipeline hack
Motorists fill up gas cans at a Shell station in Charlotte, North Carolina on Wednesday. Fuel industry representatives urged consumers to stop panic buying and say it is contributing to the crisis
At a Citgo station in East Atlanta, Charles Williams, 66, a local musician, filled his wife’s Mini Cooper after seeing people with large jerry cans loading up.
‘I wouldn’t say I know they’re hoarding, but I don’t know if they’re helping,’ he said.
Privately owned Colonial Pipeline opened portions of the line manually in Georgia, Maryland, New Jersey and the Carolinas. It also accepted 2 million barrels of fuel to begin efforts to ‘substantially’ restore operations by week’s end, the company has said.
Fuel industry representatives urged consumers to stop panic buying. They noted the country has plenty of gasoline supplies and said hoarding is creating shortages in areas not served by the pipeline.
‘Retailers right now have sold several days worth of inventory within a few hours,’ said Rob Underwood, President of the Energy Marketers of America.
Four southeastern states – Florida, North Carolina, Virginia and Georgia – joined federal regulators in relaxing driver and fuel restrictions to speed deliveries of supplies. Georgia suspended sales tax on gasoline until Saturday.
Gulf Coast refiners that move fuel to market on the Colonial Pipeline have cut processing. Total SE trimmed gasoline production at its Port Arthur, Texas, refinery, and Citgo Petroleum pared back at its Lake Charles, Louisiana, plant.
Citgo said it was moving products from Lake Charles and ‘exploring alternate supply methods into other impacted markets.’ Marathon Petroleum said it was ‘making adjustments.’
Several airlines have been transporting fuel by truck or fueling planes at destinations rather than at East Coast origins. American Airlines said it would resume on Thursday non-stop service on two long-haul flights out its Charlotte, North Carolina hub.
Delta Air Lines Chief Executive Ed Bastian said the airline has been told fuel supplies will be available ‘hopefully by the end of the week and as long as those predictions come true hopefully we’ll be OK.’
A gas pump is seen out of service in Washington DC on Wednesday due to fuel shortages. Half of the stations in Florida, Washington DC, Virginia, South Carolina, and Georgia were running dry on Thursday
Motorists line up at an Exxon station selling gas at $3.29 per gallon soon after its fuel supply was replenished in Charlotte, North Carolina on Wednesday
Long lines of cars wait for gas at a Costco in Atlanta on Wednesday morning, as a gasoline shortage across the southern Atlantic seaboard deepens after a Russian-linked cyberattack on a key oil pipeline
Pipeline hack sends motorists scrambling for fuel across the South: Scenes of chaos as long lines form and fights break out at the pump
A run on gas following a computer hack of the nation´s largest fuel pipeline had North Carolina tow-truck driver Jonathan King worried about whether he could do his job.
‘I drive all over the place,’ King said at a packed gas station outside Winston-Salem on Wednesday. ‘It gets really busy. And yeah, with the fuel going the way it´s going, it´s going to be very hard for us. Hopefully we´ll be able to get through it.’
The cybersecurity attack on the Colonial Pipeline has prompted fuel-hoarding and panic-buying in parts of the Southeastern U.S., striking fear and stress among those who’ve waited in long lines for gas. And while Colonial initiated the restart of pipeline operations late Wednesday, the company said it will take several days for deliveries to return to normal.
The scene at gas stations was far from typical Wednesday after governors of both North Carolina and Virginia declared states of emergency to help ensure supply and access to gas.
As people in the region emerge from the lockdowns and limitations of the coronavirus pandemic, some feared the prospect of lost wages and missed doctors appointments. They also worried about canceling plans with family members who they were only beginning to see again.
Motorists in Knightdale, North Carolina, on the outskirts of Raleigh, traded blows on Tuesday as frustrations boiled over in a long line for gas at a Marathon station
Mary Goldburg, 60, of Norfolk, Virginia, said she needs her car for work but also to see her grandchildren – whom she barely got to see last year. Her job includes delivering T-shirts for events and other promotional products.
‘I can´t get paid until my customers get their products,’ said Goldburg as a slow-operating pump filled her tank for more than 20 minutes at a 7-Eleven.
Construction worker Jamar Gatison, 36, was also filling up his tank there Wednesday before he had a doctor´s appointment.
‘I’m about to run out of gas, so I have no choice,’ Gatison said, adding that he is also is an Uber Eats driver but wasn’t planning on delivering food that night because he didn’t want to wait in line again.
Restaurants and bars, which are already struggling to fill job openings, will find themselves particularly squeezed, said Robert McNab, an economics professor at Virginia´s Old Dominion University. Some workers may not be able to come to work. And some customers may abandon plans to eat out.
‘In all likelihood, these service workers will be impacted most significantly, with rising fuel and food prices eating a larger part of their household budgets and income being reduced this month by the fear-induced shortage of gasoline,’ McNab said.
The Colonial Pipeline delivers about 45% of the fuel consumed on the East Coast. There is no gasoline shortage, according to government officials and energy analysts. But there has been a problem getting the fuel from refineries on the Gulf Coast to the states that need it, and officials have been scrambling to find alternate routes to deliver that fuel.
The distribution problems and panic-buying have been draining supplies at thousands of gas stations. On Wednesday, four to five cars were lined up at each pump at a Circle K in Clemmons, North Carolina, a community southwest of Winston-Salem along I-40.
Detlef Badorrek said he drove to four gas stations before he found one where he could fill up his car. He expressed concern that motorists may become a little more unnerved as the situation extends itself.
‘I sense things could go a little bit more desperately as time goes by. So far, it´s reasonable,’ he said.
A huge line forms for gasoline at Costco on Wendover Avenue in Greensboro, North Carolina, on Tuesday. As the shutdown of a major fuel pipeline entered into its fifth day, efforts are under way to stave off potential fuel shortages
A government map shows a mishmash of pipelines, petroleum ports and petroleum refineries. The Southeastern area is dependent on the Colonial Pipeline, whereas the Gulf area, the Northeast and the Midwest have other fuel sources
But not for everyone, apparently. Two people were charged with assault after a fight over spots in a line at a Marathon gas station in Knightdale, outside Raleigh, on Tuesday afternoon, authorities said.
The man and woman arguing over spots each spat in the other´s face before the fight turned physical and a cellphone was damaged, police said.
Video posted on Instagram shows two cars bumped up against each other at a gas station. The woman was charged with simple assault and the man was charged with assault on a female and damage to personal property, police said. Both were cited and released with a pending court date.
In Walton County, Georgia, paramedic Jeff Lisle had just under a quarter-tank of gas in his Jeep – but no one knew of any stations near his house that had gas. So, he went to his garage and found a small amount in the cans he uses for his lawnmower in case he needed the extra boost to make it to work.
As for the ambulances he works in, ‘we have to buy fuel at gas stations like everybody else does,’ he said. That means that whenever possible, the ambulances have been stopping to refuel when they´re lucky enough to drive past a station with gas.
Along the Appalachian Trail, which stretches from Georgia to Maine, hikers depend on car and van shuttles to access the trail and get supplies.
‘Everybody´s out here buying from the same gas pumps, so the lines are long, some are out — you´ve really got to look for it,’ said Ron Brown, who operates Ron´s Appalachian Trail Shuttles and often takes hikers from Atlanta´s airport into the north Georgia mountains..
But he said that hikers are resourceful enough to get where they need to go.
‘It will get rectified because it´s a big deal, and everybody needs gas,’ he said. ‘We´ll just make do until it does.’