Colonial Pipeline suffered a ransomware attack in 2021 that forced the U.S. energy company to shut down its entire fuel distribution pipeline -- and therefore threatened gasoline and jet fuel distribution across the U.S. east coast.
Details about the attack -- and associated fallout -- continue to surface a year later. Here is a regularly updated timeline featuring Colonial Pipeline ransomware attack details and recovery updates.
Colonial Pipeline Ransomware Attack: High-Level Details
Colonial Pipeline paid nearly $5 million to Eastern European hackers on May 7, 2021, contradicting reports that the company had no intention of paying an extortion fee to help restore the country’s largest fuel pipeline, Bloomberg reported on May 13, 2021.
On an upbeat note, Colonial Pipeline managed to resume pipeline service by May 12, 2021, though it will take a few days for the supply chain to return to normal performance.
Meanwhile, cybersecurity firm FireEye assisted the cyberattack investigation and recovery effort, multiple reports suggest -- though FireEye has not commented about attack. A group known as DarkSide was involved in the attack, the FBI confirmed.
Colonial Pipeline operates 5,500 miles of pipeline -- which stretches from Texas to New Jersey. The pipeline transports 100 million gallons of fuel per day, according to the company's website, extends across 14 states and directly services seven airports.
For MSSPs (managed security services providers), it's another timely reminder that all critical infrastructure -- fuel, power, electric, transportation, communications and more -- remains a prime target for cyberattacks and digital extortion initiatives.
Colonial Pipeline Ransomware Attack: Timeline and Status Updates
Here is a timeline featuring Colonial Pipeline ransomware attack details and recovery updates.
Tuesday, May 9, 2022:
Monday, June 7, 2021:
Thursday, May 13, 2021:
Wednesday, May 12, 2021:
Tuesday, May 11, 2021:
Monday, May 10, 2021:
Sunday, May 9, 2021: Second Colonial Pipeline Statement About Cyberattack:
"On May 7, Colonial Pipeline Company learned it was the victim of a cybersecurity attack and has since determined that the incident involved ransomware. Quickly after learning of the attack, Colonial proactively took certain systems offline to contain the threat. These actions temporarily halted all pipeline operations and affected some of our IT systems, which we are actively in the process of restoring.
Leading, third-party cybersecurity experts were also immediately engaged after discovering the issue and launched an investigation into the nature and scope of this incident. We have remained in contact with law enforcement and other federal agencies, including the Department of Energy who is leading the Federal Government response.
Maintaining the operational security of our pipeline, in addition to safely bringing our systems back online, remain our highest priorities. Over the past 48 hours, Colonial Pipeline personnel have taken additional precautionary measures to help further monitor and protect the safety and security of its pipeline.
The Colonial Pipeline operations team is developing a system restart plan. While our mainlines (Lines 1, 2, 3 and 4) remain offline, some smaller lateral lines between terminals and delivery points are now operational. We are in the process of restoring service to other laterals and will bring our full system back online only when we believe it is safe to do so, and in full compliance with the approval of all federal regulations.
At this time, our primary focus continues to be the safe and efficient restoration of service to our pipeline system, while minimizing disruption to our customers and all those who rely on Colonial Pipeline. We appreciate the patience and outpouring of support we have received from others throughout the industry."
Sunday, May 9, 2021:
Saturday, May 8, 2021:
"On May 7, the Colonial Pipeline Company learned it was the victim of a cybersecurity attack. We have since determined that this incident involves ransomware. In response, we proactively took certain systems offline to contain the threat, which has temporarily halted all pipeline operations, and affected some of our IT systems. Upon learning of the issue, a leading, third-party cybersecurity firm was engaged, and they have launched an investigation into the nature and scope of this incident, which is ongoing. We have contacted law enforcement and other federal agencies.
Colonial Pipeline is taking steps to understand and resolve this issue. At this time, our primary focus is the safe and efficient restoration of our service and our efforts to return to normal operation. This process is already underway, and we are working diligently to address this matter and to minimize disruption to our customers and those who rely on Colonial Pipeline."
Friday, May 7, 2021:
Thursday, May 6, 2021 - Hackers Launch Colonial Pipeline Cyberattack: The hackers who caused Colonial Pipeline to shut down the biggest U.S. gasoline pipeline began their blitz against the company on May 6, 2021, stealing 100 gigabytes of data before locking computers with ransomware and demanding payment. Source: Bloomberg, May 9, 2021.
The cyberattack comes amid the Biden administration's push to strengthen and further protect U.S. infrastructure from cyberattacks.
Check back for updates to this article.
Blog originally published May 8, 2021. Updated regularly thereafter.
