Colonial Pipeline reportedly paid $5 million ransom

Alleged payment contradicts the firm’s statement that it wouldn’t pay

Fuel pump with an "out of gas" sign on it

Colonial is said to have paid Eastern European hackers in Eastern Europe around $5 million last Friday, despite reports earlier this week stating the firm had no intention of paying the ransom to help bring the US’s largest pipeline back online.

According to Bloomberg, the Georgia-based company paid the ransom in virtually untraceable cryptocurrency. A source told Bloomberg that US government officials were also aware that Colonial paid the ransom to keep gas stations open and planes fueled in southeastern cities. The incident has caused fuel shortages in North and South Carolina, Georgia, Virginia, and Florida.

Once Colonial made the payment, the hackers sent the firm a decryption tool to fix its computer systems. However, the tool was slow to fix problems, leaving the pipeline company relying on backups to restore systems.

Spokespeople from Colonial and the US government declined Bloomberg’s request for comments.

According to the FBI, the hackers, known as Darkside, are in Eastern Europe or Russia and behind the attacks. Darkside reportedly expressed regret at the amount of damage it caused the company. The hackers said they were “apolitical” and didn’t “participate in geopolitics.”

Previous reports said that Colonial had no intention of paying the ransom. The FBI has discouraged organizations from paying ransom to cyber criminals, as there is no guarantee the hackers will provide tools to decrypt ransomed data.

Related Resource

Employees behaving badly?

Why awareness training matters

Why awareness training matters - whitepaper from MimecastDownload now

Darren Van Booven, lead principal consultant at Trustwave and former CISO of the US House of Representatives, told ITPro that Colonial Pipeline initially said the pipeline shutdown was precautionary. 

“If the OT environment around the pipeline operations was properly segregated and secured apart from the Colonial administrative systems, then the pipeline shouldn’t have been in any danger. If the ransomware infiltrated the administrative networks only, Colonial might have been greatly impacted, but the pipeline could have continued to run,” he said.

“The alleged payment of $5M in ransom seems excessive in the situation where the pipeline wasn’t in any real danger. The OT environment could have been somehow affected due to poor security, separation of OT from IT admin systems, or otherwise.”

Featured Resources

Modern governance: The how-to guide

Equipping organisations with the right tools for business resilience

Free Download

Cloud operational excellence

Everything you need to know about optimising your cloud operations

Watch now

A buyer’s guide to board management software

Improve your board’s performance

The real world business value of Oracle autonomous data warehouse

Lead with a 417% five-year ROI

Download now

Recommended

UK's first government cyber strategy aims to bolster public sector defences
cyber security

UK's first government cyber strategy aims to bolster public sector defences

25 Jan 2022
IT Pro Podcast: Learning to live with risk
Sponsored

IT Pro Podcast: Learning to live with risk

25 Jan 2022
Russia's "politically motivated" REvil raid could be used as leverage, experts warn
ransomware

Russia's "politically motivated" REvil raid could be used as leverage, experts warn

17 Jan 2022
Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp
phishing

Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp

21 Dec 2021

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
Dell XPS 15 (2021) review: The best just got better
Laptops

Dell XPS 15 (2021) review: The best just got better

14 Jan 2022
How to speed up Windows 11
Microsoft Windows

How to speed up Windows 11

7 Jan 2022