Colonial Pipeline: A computer intrusion ends up stopping a pipeline

On May 7, 2021, Colonial Pipeline discovered a ransomware attack. The company is shutting down operations, disrupting a major U.S. fuel supply route. The damage is not limited to a ransom displayed on a screen.

The leader explained to the Senate that an old remote connection profile, which was not supposed to be used, is considered the entry point. This is the result of an ongoing investigation. It should not become a certainty on all stages of the intrusion.

The shutdown of the pipeline is a response to the crisis. It does not prove that the attackers directly took control of each pump or valve. The distinction between compromised administrative systems and physical consequences is essential to understanding the event.

Colonial contacts the FBI and decides to pay a ransom of about 75 bitcoins to operators linked to DarkSide. The company wants to have an additional means of restoration. However, paying does not guarantee the proper functioning of a received tool or the disappearance of any stolen copies.

In June, the DOJ announced the seizure of 63.7 bitcoins from this ransom, then valued at about $2.3 million. Investigators tracked the transfers and obtained control of the address concerned. This result does not mean that Bitcoin’s encryption has been broken.

The case combines extortion, industrial continuity and financial investigation. It recalls that a computer account can have a much broader effect than the service to which it seems to give access.