A ransomware attack led one of the nation’s biggest fuel pipeline operators to shut down its entire network on Friday, according to the company and two U.S. officials familiar with the matter.
It appears to have been carried out by an Eastern European-based criminal gang — DarkSide, according to a U.S. official and another person familiar with the matter.
Federal officials and the private security firm Mandiant, a division of FireEye, are still investigating the matter, they said.
“We are engaged with the company and our interagency partners regarding the situation,” said Eric Goldstein, executive assistant director of the cybersecurity division at the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, or CISA. “This underscores the threat that ransomware poses to organizations regardless of size or sector. We encourage every organization to take action to strengthen their cybersecurity posture to reduce their exposure to these types of threats.”
President Biden was briefed on the incident on Saturday morning, a White House statement said. It said the federal government is working to assess the incident’s implications, avoid disruption to supply and help Colonial Pipeline restore operations “as quickly as possible.”
Colonial Pipeline said in a statement on Friday that it had temporarily shut down all its pipeline operations after learning it had been hit by a cyber attack on some of its “information technology” or business network systems that day. As a result, the firm said, it “proactively took certain systems offline to contain the threat.” Early on Saturday afternoon, the company confirmed that the attack “involves ransomware.” It said it had notified law enforcement and other federal agencies.
Colonial’s 5,500 miles of pipelines carry fuel from refineries on the Gulf Coast to customers in the southern and eastern United States. It says it transports 45 percent of the fuel consumed on the East Coast, reaching 50 million Americans.
Ransomware attacks, in which hackers lock up computer systems — usually by encrypting data — and demand payment to free up the system, are a global scourge. In recent years, they have affected everyone from banks and hospitals to universities and municipalities — almost 2,400 organizations in the United States were victimized last year alone, one security firm reported. But the attackers are increasingly targeting industrial sectors because these firms are more willing to pay up to regain control of their systems, experts say.
“The downtime for industrial companies can cost millions,” said Robert M. Lee, the chief executive of Dragos, a major cybersecurity firm that handles incidents in the industrial control sector.
U.S. officials and experts in industrial control security said such attacks are more common than is publicly known and that most just do not get reported.
“There are absolutely cases in industrial operations where ransomware impacts operations,” but often the stories don’t hit the news, Lee said. “There are lots of industrial control companies that are battling ransomware around the United States.”
The trend exploded in the last three years after the WannaCry and NotPetya computer worms showed cyber criminals how targeting companies in critical industrial sectors is more likely to make companies pay out, Lee said.
The DarkSide group has hit utility firms before, said Allan Liska, intelligence analyst at the cyber threat research firm Recorded Future. In February, ransomware attacks disrupted operations at two Brazilian state-owned electric utility companies, Centrais Eletricas Brasileiras (Eletrobras) and Companhia Paranaense de Energia (Copel), he said.
Private firms that investigate cyber intrusions say they are handling cases involving DarkSide using ransomware to target American industrial companies. But there are many other ransomware groups that seem to be targeting such firms in greater numbers than ever before, analysts said.
Carrying off a ransomware attack does not require great technical sophistication, Liska said. In the world of criminal ransomware operations, some crews specialize in gaining access and others pay for that access and then lock up the data, he said. DarkSide generally falls into the lock up crew category, he said.
“The last few years have been incredibly busy” because the proliferation of vulnerabilities in firewalls and virtual private networks have allowed ransomware criminals to gain access to networks at an unprecedented scale, Lee said.
“To put it simply, we are on the cusp of a global digital pandemic driven by greed,” former top DHS cyber official Christopher Krebs told Congress on Wednesday. He called the ransomware emergency a “digital dumpster fire.”
Last year, CISA warned pipeline operators about the threat of ransomware. CISA responded to a ransomware attack on a natural gas compression facility in which the attacker gained access to the corporate network and then pivoted to the operational network, where it encrypted on various devices. As a result, the firm shut down operations for about two days, CISA said.
The DHS warning to operators came after members of Congress in 2018 urged the agency to do more to protect pipelines from cyber attacks.
Though there is as yet no known foreign government nexus to the Colonial Pipeline incident, the U.S. government has in the past asserted links between Russian spy services and ransomware rings. Last month, the Treasury Department stated that the Russian internal security service, FSB, “cultivates and co-opts criminal hackers, including” a group called Evil Corp., “enabling them to engage in disruptive ransomware attacks.” Treasury sanctioned Evil Corp. in late 2019.
Cybersecurity researchers believe that DarkSide operates mostly out of Russia, which U.S. officials and cybersecurity experts have accused of harboring cyber criminals. These criminals avoid targeting victims in Russia, experts say.
In January 2019, the Director of National Intelligence, Daniel Coats, warned at an annual worldwide threat briefing that China has the ability to launch cyber attacks that cause temporary disruptive effects on critical infrastructure, “such as disruption of a natural gas pipeline for days to weeks” in the United States. He did not specify what type of cyber tool or mention ransomware explicitly.
A task force of more than 60 experts from industry, government, nonprofits and academia last month urged a series of coordinated actions by industry, government and civil society. Their recommendations include mandating that organizations report ransom payments and requiring them to consider alternatives before making payments. Governments, they said, could provide support to help firms hold out longer. The recommendations also call for global diplomatic and law enforcement efforts to induce countries from providing safe havens to ransomware criminals.
“Proposing this framework is merely the first step,” the task force said, “and the real challenge is in implementation.”
The Biden administration is expected in the coming weeks to issue an executive order aimed at shoring up the cybersecurity of federal civilian agencies. Though it will not specifically address private critical infrastructure, it is expected to drive standards for federal contractors that experts hope will ripple across the private sector.
Last month, the White House and Energy Department launched a 100-day action plan focused on boosting the cybersecurity of electricity sector industrial systems. The idea is to eventually expand that effort to gas pipelines and water systems.
Prices for refined oil products are slumping on the Gulf Coast because of the shutdown. Analysts say that depending on how long the pipelines are out of service, prices for gasoline and jet fuel could rise in the New York area, as they did in 2017 when a hurricane forced a shutdown.
Bob McNally, founder of the Rapidan Energy Group, said although the shutdown of the Colonial system is “massive,” if the company is able to restart operations within a couple of days, he does not expect an impact on fuel prices.
“The critical thing now is the duration,” he said. “Right now, everything depends this weekend on news that the market gets about the duration of the outage.”
Storage in both the Gulf Coast region and the Northeast “can largely mitigate the impact of a short-term event,” said Bernadette Johnson, senior vice president of power and renewables at a company called Enverus.
But if the shutdown lasts much longer than a few days, there could be a cascade of dramatic impacts, including higher prices and consumer hoarding of gasoline supplies, McNally said. Gasoline prices have been edging higher in recent weeks, in line with typical seasonal trends.
The Colonial pipeline system “is an irreplaceable, vital jugular for fuel supply to the East Coast,” McNally said. “It’s the major artery and there are no real other good options to replace it.”
One of Colonial’s two pipelines ruptured last summer in North Carolina, spilling 1.2 million gallons of gasoline, the largest spill in the state’s history.
On March 29, the Pipeline and Hazardous Materials Safety Administration (PHMSA), a division of the Department of Transportation, informed Colonial that its investigation of the North Carolina spill raised serious concerns about safety.
“PHMSA’s ongoing investigation indicates that conditions may exist on the Colonial Pipeline System that pose a pipeline integrity risk to public safety, property or the environment,” it said in a proposed safety order.
“The conditions that led to the failure potentially exist throughout the Colonial Pipeline System. Further, Colonial’s inability to effectively detect and respond to this release, as well as other past releases, has potentially exacerbated the impacts of this and numerous other failures over the operational history of Colonial’s entire system. ... It appears that the continued operation of the Colonial Pipeline System without corrective measures would pose a pipeline integrity risk to public safety, property, or the environment.”
In 2016, a Colonial pipeline exploded and released 4,400 barrels of gasoline into a pond in Shelby County, Ala. One worker was killed. Recovery and repair procedures were hampered by dangerous clouds of gasoline and benzene vapors, PHMSA reported.
Later that year, an underground leak of more than 7,000 barrels was discovered by a mine inspector in Alabama. That leak was attributed to pipe fatigue caused by improper preparation of the soil beneath it. For both incidents, the company agreed to pay the state $3.3 million to cover damages and penalties.
