Major US pipeline halts operations after ransomware attack

A major pipeline operator transporting fuel across the eastern coast said on Saturday that it had fallen victim to a ransomware attack and had halted all pipeline operations to deal with the threat. Experts said the attack was unlikely to affect gasoline supplies and prices unless it led to a prolonged pipeline shutdown.

The colonial pipeline did not say what was needed or who made the request. Ransomware attacks are usually carried out by criminal hackers who mix data, paralyze victims' networks, and demand large sums of money to decrypt it.

The attack on the company, which says it supplies roughly 45% of the spent fuel on the East Coast, once again underscores vulnerabilities in critical infrastructure to malicious cyberattacks that threaten to disrupt operations. It represents a new challenge for an administration that has still been grappling with its response to major breaches for months, including a massive infringement of government agencies and companies because of which the United States imposed sanctions on Russia last month.

In this case, Colonial Pipeline said Friday's ransomware attack affected some of its IT systems and that the company had moved "preemptively" to shut down certain systems, halting pipeline operations. In a previous statement, she said she was "taking steps to understand and solve this problem" with a focus on returning to normal processes.

Georgia-based Alpharetta delivers gasoline, diesel, jet fuel and home heating oil from refineries on the Gulf Coast via pipelines running from Texas to New Jersey. Its pipeline system stretches over 5,500 miles, and moves more than 100 million gallons per day.

The White House said President Joe Biden was briefed on Saturday morning and that the federal government was working with the company to assess the fallout from the attack, restore operations and avoid supply disruptions. The government plans various scenarios and is working with state and local authorities on measures to mitigate any potential supply issues.

FireEye, a private cybersecurity firm, said it has been contracted to manage the incident response investigation.

Oil analyst Andy Lipo said the impact of the attack on fuel supplies and prices depended on the hot news length of the pipeline. He said that the interruption of one or two days would be minimal, but that the interruption of five or six days could cause price shortages and higher prices, especially in an area stretching from central Alabama to the Washington DC area.

The main concern about the news long delays, Lipo said, was the aviation fuel needed to keep major airports operating, such as those in Atlanta and Charlotte, North Carolina.

Robert Lee, a leading expert in industrial control systems, said systems such as those that directly direct pipeline operation have been increasingly connected to computer networks in the past decade.

But critical infrastructure companies in the power and electricity industries also tend to invest more in cybersecurity than other sectors. He told me that if the Colonial lockdown was mostly precautionary - and detected the ransomware attack early and was well prepared - the effect might not be that great.

While there have long been concerns that news trend adversaries of the United States are disrupting American energy suppliers, ransomware attacks by criminal gangs are more common and have risen recently. The Department of Justice has a new task force dedicated to countering ransomware attacks.

The attack "underscores the threat that ransomware poses to hot news organizations, regardless of size or sector," said Eric Goldstein, Associate Executive Director of the Cybersecurity Division at the Federal Security and Infrastructure Agency for Cybersecurity and Security.