The Colonial Pipeline is the largest refined oil production pipeline system in the United States, spanning 8500 km and running from Houston, Texas to Linden, New Jersey.
Given its massive operational capacity and critical role, a single incident managed to halt the entire system for nearly a week. We are talking about the Colonial Pipeline Ransomware Attack that occurred on May 7, 2021.
What is a ransomware attack?
It is a type of malicious cyberattack where cybercriminals use specialised software to encrypt or block access to the victim’s critical data, system or files. To regain access to their data, the victim is typically forced to pay a ransom.
The Perpetrators Of The Attack
DarkSide, an Eastern European cybercriminal group known for operating under a ransomware-as-a-service model, gained entry to the pipeline’s entire IT network, through a single compromised password associated with an inactive VPN.
The specific VPN account had Multi Factor Authentication disabled, meaning the leaked credentials were all the information hackers needed to get in.
The Chaos That Followed
The hackers stole approximately 100 gigabytes of data and deployed ransomware to lock down the company’s billing, accounting and IT management systems. The hackers demanded a ransom of 75 bitcoins, valued at $4.4 million at that time.
The Immediate Steps Taken
Although the attack targeted IT systems, the pipeline leadership proactively shut the entire system to prevent the malware from spreading further. The multi-day shutdown affected 13 states and Washington D.C. along the U.S. East Coast, triggering severe fuel shortages.
The federal government, under President Joe Biden, imposed a regional state of emergency, allowing temporary waivers for motor carriers and drivers supplying fuel to keep the supply going.
The Colonial Pipeline paid the entire ransom amount in exchange for a decryption tool. However, the Department of Justice later announced that they were able to recover 84% of the amount paid to the hackers.
The pipeline gradually resumed normal operations, restarting on May 12, 2021 and fully functional from May 15, 2021.
Conclusion
The incident shed light on how important it is for private sector critical infrastructure to undertake robust cybersecurity measures. Following the incident, the U.S. government and critical infrastructure sectors implemented major regulatory shifts and policy actions to prevent a recurrence.
The Transportation Security Administration (TSA), the agency overseeing pipeline security, shifted away from voluntary guidelines. It issued binding emergency directives requiring critical pipeline operators to report cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA) within 24 hours, designate a cybersecurity coordinator, and audit their own IT/OT network architectures.
MUSKAN SINGH
