Cyberattack disrupts Colonial Pipeline, which transports 100 million gallons of fuel daily

Colonial Pipeline is one of the largest operators in the U.S.

A cyberattack has temporarily halted operations at Colonial Pipeline, the largest pipeline system for moving gas and diesel products in the U.S., the company said Friday.

Colonial Pipeline, which delivers more than 100 million gallons of fuel daily to customers from Texas to New York, said that after learning of the incident on Friday that it “proactively took certain systems offline to contain the threat, which has temporarily halted all pipeline operations and affected some of our IT systems.”

It was unclear at press time Saturday morning who was responsible for the digital intrusion or how long the company’s pipeline operations would be halted. A Colonial Pipeline spokesperson declined to comment beyond the company’s statement.

The Department of Homeland Security’s cybersecurity agency said that ransomware was the cause of the incident in a statement Saturday afternoon.

“This underscores the threat that ransomware poses to organizations regardless of size or sector,” DHS’s Cybersecurity and Infrastructure Security Agency (CISA) said, adding that it was working with Colonial Pipeline to address the issue.

Colonial Pipeline said it had contacted law enforcement, and that efforts to restore normal operations were “already underway.”

“[W]e are working diligently to address this matter and to minimize disruption to our customers and those who rely on Colonial Pipeline,” the statement continued.

A White House spokesperson said that President Joe Biden was briefed on the incident Saturday morning.

“The federal government is working actively to assess the implications of this incident, avoid disruption to supply, and help the company restore pipeline operations as quickly as possible,” the White House spokesperson said.

As the operators of the nation’s 2.7 million miles of pipelines for oil, natural gas, and other hazardous liquids embrace digital technology to run their businesses more efficiently, concerns about their susceptibility to hackers have grown. The Department of Homeland Security in February 2020 revealed that a ransomware attack on an unnamed natural gas compression facility caused the organization to shut down its operations for two days.

A breach of the IT services that pipeline operators use to process transactions can also be a risk to business. In April 2018, a hack of a billing software vendor used by Texas-based Energy Transfer Partners LP, which owns more than 71,000 miles of pipelines, forced the company to process transactions on its own until the issue was resolved.

Cybercriminals looking for payouts have in recent years gone after companies in the oil and gas sector, just as they have just about every other sector.

Apart from the apparently cybercriminal incidents involving ransomware at companies like Colonial Pipeline, energy companies have had to consider other threats when building network defenses. Broadly speaking, U.S. national security officials have warned for years that state-sponsored hackers from Russia and elsewhere had demonstrated an interest in mapping vulnerabilities in U.S. critical infrastructure such as electric systems and pipelines.

In general, “China has the ability to launch cyberattacks that cause localized, temporary disruptive effects on critical infrastructure—such as disruption of a natural gas pipeline for days to weeks,” U.S. intelligence agencies said in a 2019 assessment of global security threats.

U.S. lawmakers in late 2018 called on DHS to step up its cybersecurity guidelines and services to support pipeline operators out of concern the U.S. government was not doing enough.

DHS and Department of Energy officials that year announced an initiative to coordinate with oil and gas executives more closely on pipeline cybersecurity. In February, CISA published cybersecurity assessment tools meant to strengthen the defenses of pipeline operators.

UPDATE, 06:37 p.m. EDT: This story has been updated with a statement from the White House. 

UPDATE, 07:56 p.m. EDT: This story has been updated with a statement from the Department of Homeland Security.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure