Colonial is said to have paid Eastern European hackers in Eastern Europe around $5 million last Friday, despite reports earlier this week stating the firm had no intention of paying the ransom to help bring the US’s largest pipeline back online.
According to Bloomberg, the Georgia-based company paid the ransom in virtually untraceable cryptocurrency. A source told Bloomberg that US government officials were also aware that Colonial paid the ransom to keep gas stations open and planes fueled in southeastern cities. The incident has caused fuel shortages in North and South Carolina, Georgia, Virginia, and Florida.
Once Colonial made the payment, the hackers sent the firm a decryption tool to fix its computer systems. However, the tool was slow to fix problems, leaving the pipeline company relying on backups to restore systems.
Spokespeople from Colonial and the US government declined Bloomberg’s request for comments.
According to the FBI, the hackers, known as Darkside, are in Eastern Europe or Russia and behind the attacks. Darkside reportedly expressed regret at the amount of damage it caused the company. The hackers said they were “apolitical” and didn’t “participate in geopolitics.”
Previous reports said that Colonial had no intention of paying the ransom. The FBI has discouraged organizations from paying ransom to cyber criminals, as there is no guarantee the hackers will provide tools to decrypt ransomed data.
Darren Van Booven, lead principal consultant at Trustwave and former CISO of the US House of Representatives, told ITPro that Colonial Pipeline initially said the pipeline shutdown was precautionary.
“If the OT environment around the pipeline operations was properly segregated and secured apart from the Colonial administrative systems, then the pipeline shouldn’t have been in any danger. If the ransomware infiltrated the administrative networks only, Colonial might have been greatly impacted, but the pipeline could have continued to run,” he said.
“The alleged payment of $5M in ransom seems excessive in the situation where the pipeline wasn’t in any real danger. The OT environment could have been somehow affected due to poor security, separation of OT from IT admin systems, or otherwise.”
