Cyberattack shuts pipeline
Major U.S. fuel transporter halts operations after a ransomware strike.
WASHINGTON — The operator of a pipeline that transports fuel across the East Coast said Saturday it was the victim of a ransomware attack and temporarily halted all pipeline operations.
Colonial Pipeline did not say what was demanded or by whom, but ransomware attacks typically involve criminal hackers who seize data and demand a large payment to release it.
In a statement, Colonial Pipeline Co. said the attack took place Friday and also affected some of its information technology systems. The company describes itself as operating the largest refined products pipeline in the United States, transporting roughly 45% of all fuel, including gasoline, diesel fuel and home heating oil, that is consumed on the East Coast. The Alpharetta, Ga.-based company said it hired an outside cybersecurity firm to investigate the attack and has also contacted law enforcement and federal agencies.
“Colonial Pipeline is taking steps to understand and resolve this issue,” the company said in a statement late Friday. “At this time, our primary focus is the safe and efficient restoration of our service and our efforts to return to normal operation. This process is already underway, and we are working diligently to address this matter and to minimize disruption to our customers and those who rely on Colonial Pipeline.”
Mike Chapple, teaching professor of information technology, analytics and operations at the University of Notre Dame’s Mendoza College of Business and a former computer scientist with the National Security Agency, said systems that control pipelines should not be connected to the internet and vulnerable to cyber intrusions.
“The attacks were extremely sophisticated and they were able to defeat some pretty sophisticated security controls, or the right degree of security controls weren’t in place,” Chapple said.
Colonial Pipeline said it transports more than 100 million gallons of fuel daily, through a pipeline system spanning more than 5,500 miles between Texas and New Jersey.
The FBI and the White House’s National Security Council did not immediately return messages seeking comment. The federal Cybersecurity Infrastructure and Security Agency referred questions about the incident to the company.
A hacker’s botched attempt to poison the water supply of a small Florida city raised alarms about how vulnerable the nation’s crucial infrastructure may be to attacks by more sophisticated intruders.
Anne Neuberger, the Biden administration’s deputy national security advisor for cybersecurity and emerging technology, said in an interview with the Associated Press in April that the government was undertaking a new effort to help electric utilities, water districts and other crucial industries protect against potentially damaging cyberattacks. She said the goal was to ensure that control systems serving 50,000 or more Americans have the core technology to detect and block malicious cyberactivity.
Since then, the White House has announced a 100day initiative aimed at protecting the country’s electricity system from cyberattacks by encouraging operators of power plants and electric utilities to improve their capabilities for identifying threats to their networks. It includes specific milestones for them to put technologies into place so they can detect and immediately respond to intrusions.
The Justice Department has also announced a new task force dedicated to countering ransomware attacks in which data are seized by hackers who demand payment from victims in order to release it.
‘The attacks were ... able to defeat some pretty sophisticated security controls, or the right degree of security controls weren’t in place.’ — Mike Chapple, University of Notre Dame teaching professor and former NSA computer scientist