IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Colonial Pipeline reportedly paid $5 million ransom

Alleged payment contradicts the firm’s statement that it wouldn’t pay

Fuel pump with an "out of gas" sign on it

Colonial is said to have paid Eastern European hackers in Eastern Europe around $5 million last Friday, despite reports earlier this week stating the firm had no intention of paying the ransom to help bring the US’s largest pipeline back online.

According to Bloomberg, the Georgia-based company paid the ransom in virtually untraceable cryptocurrency. A source told Bloomberg that US government officials were also aware that Colonial paid the ransom to keep gas stations open and planes fueled in southeastern cities. The incident has caused fuel shortages in North and South Carolina, Georgia, Virginia, and Florida.

Once Colonial made the payment, the hackers sent the firm a decryption tool to fix its computer systems. However, the tool was slow to fix problems, leaving the pipeline company relying on backups to restore systems.

Spokespeople from Colonial and the US government declined Bloomberg’s request for comments.

According to the FBI, the hackers, known as Darkside, are in Eastern Europe or Russia and behind the attacks. Darkside reportedly expressed regret at the amount of damage it caused the company. The hackers said they were “apolitical” and didn’t “participate in geopolitics.”

Previous reports said that Colonial had no intention of paying the ransom. The FBI has discouraged organizations from paying ransom to cyber criminals, as there is no guarantee the hackers will provide tools to decrypt ransomed data.

Related Resource

Employees behaving badly?

Why awareness training matters

Why awareness training matters - whitepaper from MimecastDownload now

Darren Van Booven, lead principal consultant at Trustwave and former CISO of the US House of Representatives, told ITPro that Colonial Pipeline initially said the pipeline shutdown was precautionary. 

“If the OT environment around the pipeline operations was properly segregated and secured apart from the Colonial administrative systems, then the pipeline shouldn’t have been in any danger. If the ransomware infiltrated the administrative networks only, Colonial might have been greatly impacted, but the pipeline could have continued to run,” he said.

“The alleged payment of $5M in ransom seems excessive in the situation where the pipeline wasn’t in any real danger. The OT environment could have been somehow affected due to poor security, separation of OT from IT admin systems, or otherwise.”

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

Mastering endpoint security implementation
Security

Mastering endpoint security implementation

18 May 2022
The Total Economic Impact™ of Apple Mac in Enterprise: M1 update
Whitepaper

The Total Economic Impact™ of Apple Mac in Enterprise: M1 update

12 May 2022
Dell Technologies World 2022: Dell unveils fastest storage architecture in company history
Server & storage

Dell Technologies World 2022: Dell unveils fastest storage architecture in company history

4 May 2022
Dell Technologies World 2022: Dell unveils security offerings for major cloud providers
public cloud

Dell Technologies World 2022: Dell unveils security offerings for major cloud providers

3 May 2022

Most Popular

Europe's first autonomous petrol station opens in Lisbon
automation

Europe's first autonomous petrol station opens in Lisbon

23 May 2022
Nvidia pauses hiring to help cope with inflation
Careers & training

Nvidia pauses hiring to help cope with inflation

23 May 2022
Open source packages with millions of installs hacked to harvest AWS credentials
hacking

Open source packages with millions of installs hacked to harvest AWS credentials

24 May 2022