Colonial Pipeline reportedly paid $5 million ransom

Alleged payment contradicts the firm’s statement that it wouldn’t pay

Fuel pump with an "out of gas" sign on it

Colonial is said to have paid Eastern European hackers in Eastern Europe around $5 million last Friday, despite reports earlier this week stating the firm had no intention of paying the ransom to help bring the US’s largest pipeline back online.

According to Bloomberg, the Georgia-based company paid the ransom in virtually untraceable cryptocurrency. A source told Bloomberg that US government officials were also aware that Colonial paid the ransom to keep gas stations open and planes fueled in southeastern cities. The incident has caused fuel shortages in North and South Carolina, Georgia, Virginia, and Florida.

Once Colonial made the payment, the hackers sent the firm a decryption tool to fix its computer systems. However, the tool was slow to fix problems, leaving the pipeline company relying on backups to restore systems.

Spokespeople from Colonial and the US government declined Bloomberg’s request for comments.

According to the FBI, the hackers, known as Darkside, are in Eastern Europe or Russia and behind the attacks. Darkside reportedly expressed regret at the amount of damage it caused the company. The hackers said they were “apolitical” and didn’t “participate in geopolitics.”

Previous reports said that Colonial had no intention of paying the ransom. The FBI has discouraged organizations from paying ransom to cyber criminals, as there is no guarantee the hackers will provide tools to decrypt ransomed data.

Related Resource

Employees behaving badly?

Why awareness training matters

Why awareness training matters - whitepaper from MimecastDownload now

Darren Van Booven, lead principal consultant at Trustwave and former CISO of the US House of Representatives, told ITPro that Colonial Pipeline initially said the pipeline shutdown was precautionary. 

“If the OT environment around the pipeline operations was properly segregated and secured apart from the Colonial administrative systems, then the pipeline shouldn’t have been in any danger. If the ransomware infiltrated the administrative networks only, Colonial might have been greatly impacted, but the pipeline could have continued to run,” he said.

“The alleged payment of $5M in ransom seems excessive in the situation where the pipeline wasn’t in any real danger. The OT environment could have been somehow affected due to poor security, separation of OT from IT admin systems, or otherwise.”

Featured Resources

How to choose an AI vendor

Five key things to look for in an AI vendor

Download now

The UK 2020 Databerg report

Cloud adoption trends in the UK and recommendations for cloud migration

Download now

2021 state of email security report: Ransomware on the rise

Securing the enterprise in the COVID world

Download now

The impact of AWS in the UK

How AWS is powering Britain's fastest-growing companies

Download now

Recommended

ProtectedBy.AI’s CodeLock blocks malware at source code level
software as a service (SaaS)

ProtectedBy.AI’s CodeLock blocks malware at source code level

9 Jun 2021
Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
CISOs aren’t leading by example when it comes to cyber security
cyber security

CISOs aren’t leading by example when it comes to cyber security

24 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021

Most Popular

Ten-year-old iOS 4 recreated as an iPhone app
iOS

Ten-year-old iOS 4 recreated as an iPhone app

10 Jun 2021
Fastly blames software bug for major outage
public cloud

Fastly blames software bug for major outage

9 Jun 2021
GitHub to prohibit code that’s used in active attacks
cyber security

GitHub to prohibit code that’s used in active attacks

7 Jun 2021