US declares emergency after ransomware shuts oil pipeline that pumps 100 million gallons a day

Oil transport by road allowed after Colonial Pipeline goes down, operator says recovery is under way but offers no recovery date

Updated One of the USA’s largest oil pipelines has been shut by ransomware, leading the nation's Federal Motor Carrier Safety Administration to issue a regional emergency declaration permitting the transport of fuel by road.

The Colonial Pipeline says it carries 100 million gallons a day of refined fuels between Houston, Texas, and New York Harbor, or 45 percent of all fuel needed on the USA’s East Coast. The pipeline carries fuel for cars and trucks, jet fuel, and heating oil.

It’s been offline since May 7, according to a company statement, due to what the outfit described as “… a cybersecurity attack [that] involves ransomware.”

It added: “In response, we proactively took certain systems offline to contain the threat, which has temporarily halted all pipeline operations, and affected some of our IT systems.”

Third-party experts were engaged to probe and remediate the situation and by Saturday the company said it was “actively in the process of restoring” its technology operations.

The Federal Motor Carrier Safety Administration's emergency declaration was issued on Sunday evening, US time, and states it is necessary to relieve shortages.

Reuters reports that the DarkSide ransomware gang is thought to be behind the attack. DarkSide is thought to both encrypt victims’ data and exfiltrate it to gain leverage in ransom negotiations. The gang has also shared evidence that it has made charitable donations, and said it feels an obligation to share some of the ransoms it wins.

At the time of writing the pipeline remained closed, although a Sunday evening (US time) update to Colonial’s announcement said some “smaller lateral lines between terminals and delivery points” have been restored.

Exactly what the incident will mean for supply is not known. The Register has encountered conflicting reports, some saying reserves should mean little disruption, others suggesting shortages may be imminent.

Whatever comes next, the incident validates the many predictions that attacks on critical infrastructure have the potential for enormous disruption and harm.

Despite such warnings not being novel, Colonial Pipeline appears not to have worked towards short recovery time objectives.

The US Justice Department two weeks ago established a Ransomware and Digital Extortion Task Force to fight the scourge. ®

Updated to add

In a statement on May 10 fingering the culprits of the attack, the FBI said "the Darkside ransomware is responsible for the compromise of the Colonial Pipeline networks. We continue to work with the company and our government partners on the investigation."

Meanwhile, on its Tor-hidden website, the Darkside crew seems to regret the attention it has drawn from Uncle Sam. "From today we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future," it wrote.