Hackers of Colonial Pipeline steal data a day ahead of ransomware lockdown

Washington

THE hackers who caused Colonial Pipeline to shut down the biggest US petrol pipeline last Friday began their blitz against the company a day earlier, stealing a large amount of data before locking computers with ransomware and demanding payment, according to sources.

The intruders, who are part of a cybercrime gang called DarkSide, took nearly 100 gigabytes of data out of the Alpharetta, Georgia-based company's network in just two hours on Thursday, two sources said.

The move was part of a double-extortion scheme that is one of the group's hallmarks. Colonial was threatened that the stolen data would be leaked to the Internet while the information that was encrypted by the hackers on computers inside the network would remain locked unless it paid a ransom, said the sources.

The company didn't immediately respond to requests to comment on the investigation. It said earlier that it "proactively took certain systems offline to contain the threat, which has temporarily halted all pipeline operations, and affected some of our IT systems".

Colonial's decision late on Friday to shut down a pipeline that is the main source of petrol, diesel and jet fuel for the US East Coast, without saying when it would reopen, represents a dangerous new escalation in the fight against ransomware, which President Joe Biden's administration has identified as a priority.

It's not clear how much money the attackers demanded or whether Colonial has paid. Ransomware demands can range from several hundred dollars to millions of dollars in cryptocurrency. Many companies pay, often facilitated by their insurers.

AXA, one of Europe's top insurance companies, said last week that it would break with that trend and stop offering policies in France that reimburse customers for payments made to ransomware hackers, which could be the first in the industry, the Associated Press reported.

Cyberattacks have disrupted the operations of other energy assets in the US in recent years. Last year, the Department of Homeland Security revealed that an attack brought down an unnamed natural gas compressor facility for two days. In April 2018, several natural gas pipeline operators had service interruptions because of the hack of a third-party provider whose technology enables electronic communications between the entities.

The theft of Colonial's data, coupled with the detonation of ransomware on the company's computers, highlights the leverage that hackers often have over their victims in these kinds of cases. The company said FireEye Inc's Mandiant digital forensics division is assisting with the investigation.

The White House said that Mr Biden was briefed on the incident on Saturday morning.

A series of major cyberattacks in recent weeks also underscored the brazenness of the attackers and the challenges of tackling the problem of ransomware.

In a matter of days, attacks were revealed against the police department in Washington, DC, where the hackers threatened to release information about police informants to criminal gangs; the Illinois Attorney General's office, which had been warned about weak cybersecurity practices in a recent state audit; and San Diego-based Scripps Health, where medical procedures were cancelled and emergency patients diverted to other hospitals. BLOOMBERG

READ MORE: US fuel sellers scramble to make delivery after hackers shut pipeline