One of the largest pipelines in the US has been shut down after an apparent cyber-attack, its operator has said.
Colonial Pipeline said it had shut down its 5,500 miles of pipeline, which carries 45% of the east coast’s fuel supplies and travels through 14 southern and eastern US states, after the breach of its computer networks.
The pipeline transports gasoline, diesel and jet fuel. The company’s website says it carries some 100m gallons of fuel each day and services seven airports. The attack, which took place on Friday, included ransomware according to the Washington Post.
In a statement, the company said: “Colonial Pipeline is taking steps to understand and resolve this issue. At this time, our primary focus is the safe and efficient restoration of our service and our efforts to return to normal operation. This process is already under way, and we are working diligently to address this matter and to minimize disruption to our customers and those who rely on Colonial Pipeline.”
A third-party cybersecurity firm was hired to investigate the attack and federal agencies and law enforcement were informed.
The precise nature of the attack was unclear, including who launched it and what the motives were. A Colonial Pipeline spokesperson declined to say whether the company had received a ransom demand, as is common in attacks from cybercriminal syndicates.
Ransomware works by scrambling a victim organization’s data with encryption. The criminals leave instructions how to negotiate ransom payments and, once paid, provide software decryption keys to undo the damage. While there have long been fears about US adversaries disrupting American energy suppliers, criminal ransomware attacks are much more common and have become increasingly common.
The attack comes after news of the Biden administration’s 100-day plan to protect the nation’s critical infrastructure against cybersecurity threats. The US’s Department of Energy, the Cybersecurity and Infrastructure Security Agency, and the electricity industry are working together to “confront cyber threats from adversaries who seek to compromise critical systems that are essential to US national and economic security”.
The Colonial Pipeline attack is the latest incident to prompt the issue of modernizing and strengthening cybersecurity in America’s critical infrastructure.
In February, a water treatment plant in Florida was hacked and a Russian attack on the Texas-based SolarWinds IT company potentially left tens of thousands of customers exposed, which prompted the Biden administration to level sanctions against Russia.
