Colonial Pipeline ransomware attack

The pipeline network operated by Colonial Pipeline carries gasoline, diesel, and jet fuel from Texas to New York. About 45% of all fuel consumed on the East Coast arrives via the pipeline system. The attack occurred amid rising concerns about the vulnerability of critical infrastructure to cyberattacks, following several high-profile incidents, such as the 2020 SolarWinds hack, which affected multiple U.S. federal government agencies, including the Departments of Defense, Treasury, State, and Homeland Security. == Attack ==

The attackers gained access to the system using a compromised password for an inactive virtual private network (VPN) account, which did not have multi-factor authentication enabled. ==Consequences==

The attack primarily targeted the company's billing infrastructure. However, the oil pumping systems remained operational. According to CNN sources within the company, the inability to bill customers was cited as the reason for halting pipeline operations. Colonial Pipeline reported shutting down the pipeline as a precaution, citing concerns that hackers might have accessed information enabling further attacks on vulnerable infrastructure. The day after the attack, Colonial Pipeline stated it could not confirm when the pipeline would resume normal operations. On May 9, Colonial stated they planned to substantially repair and restore the pipeline's operations by the end of the week. In response to fuel shortages at Charlotte Douglas International Airport following the pipeline shutdown, American Airlines temporarily adjusted its flight schedules. At least two flights, to Honolulu and London, required additional fuel stops or plane changes over a four-day period. The shortage also led Hartsfield–Jackson Atlanta International Airport to rely on alternative fuel suppliers. At least five other airports were also directly affected by the pipeline shutdown. Fuel shortages emerged at filling stations, exacerbated by panic buying, as the pipeline shutdown entered its fourth day. Fuel shortages were reported in Alabama, Florida, Georgia, North Carolina, and South Carolina. while in Washington D.C., 87% of stations had run out by May 14. Average fuel prices rose to their highest level since 2014, exceeding $3 per gallon. Experts have stated that the attacks were preventable but that essential protective measures were not in place. Although the East Coast gasoline shortage and DarkSide's receipt of the ransom had significant consequences, they were not the most critical implications of the incident. The broader concern was the cybersecurity vulnerabilities and their potential impact on critical infrastructure in the United States. ==Responses==

U.S. President Joe Biden declared a state of emergency on May 9, 2021. During regular times there were limits on the amount of petroleum products that could be transported by road, rail, etc., domestically within the U.S. mainland. However, with the declaration in place, these were temporarily suspended. On May 10, Georgia Governor Brian Kemp declared a state of emergency, and temporarily waived collection of the state's taxes on motor fuels (diesel and gasoline). In response to panic buying in the Southeast, U.S. Transportation Secretary Pete Buttigieg and U.S. Energy Secretary Jennifer Granholm on May 12 both cautioned against gasoline hoarding, reiterating that the United States was undergoing a "supply crunch" rather than a gas shortage. On May 12, the U.S. Consumer Product Safety Commission advised people to "not fill plastic bags with gasoline" or to use any containers not meant for fuel. on May 12, increasing software security standards for sales to the government, tighten detection and security on existing systems, improve information sharing and training, establish a Cyber Safety Review Board, and improve incident response. The United States Department of Justice also convened a cybersecurity task force to increase prosecutions. The Department of State issued a statement that a $10,000,000 reward would be given out in case of information leading to the arrest of DarkSide members. Perpetrators DarkSide released a statement on May 9 that did not directly mention the attack, but claimed that "our goal is to make money, and not creating problems for society." == Pipeline restart ==

The restart of pipeline operations began at 5 p.m. on May 12, ending a six-day shutdown, although Colonial Pipeline Company warned that it could take several more days for service to return to normal. The pipeline company stated that several markets that are served by the pipeline may experience, or continue to experience, intermittent service interruptions during the restart. The company also stated that they would move as much gasoline, diesel and jet fuel as safely possible until markets return to normal. All Colonial Pipeline systems and operations had returned to normal by May 15. In a May 19, 2021, interview with The Wall Street Journal, Joseph Blount said why he ultimately decided to pay a $4.4 million ransom to hackers who breached the company's systems; "It was the right thing to do for the country." He also said, "I know that's a highly controversial decision". ==Investigations==

Biden said on May 10 that though there was no evidence that the Russian government was responsible for the attack, there was evidence that the DarkSide group is in Russia, and that thus, Russian authorities "have some responsibility to deal with this". In the aftermath of the attack, it was revealed at a Senate Armed Services cyber subcommittee hearing that the Department of Homeland Security was not alerted to the ransomware attack and that the Justice Department was not alerted to the ransom type or amount, prompting discussion about the numerous information silos in the government and difficulties of sharing. Blockchain analytics firm Elliptic published a bitcoin wallet report showing $90 million in bitcoin ransom payments were made to DarkSide or DarkSide affiliates over the last year, originating from 47 distinct wallets. According to a DarkTracer release of 2226 victim organizations since May 2019, 99 organizations have been infected with the DarkSide malware – suggesting that approximately 47% of victims paid a ransom and that the average payment was $1.9 million. The DarkSide developer had received bitcoins worth $15.5 million (17%), with the remaining $74.7 million (83%) going to the various affiliates. Partial ransom recovery by the FBI. The U.S. Department of Justice issued a press release on June 7, 2021, stating that it had seized 63.7 Bitcoins from the original ransom payment. Through possession of the private key of the ransom account, the FBI was able to retrieve the Bitcoin, though it did not disclose how it obtained the private key. ==See also==