A cyber attack forced the shutdown of one of the largest pipelines in the United States in what appeared to be a major attempt to disrupt the vulnerable energy infrastructure. The pipeline carries refined gasoline and jet fuel up the east coast from Texas to New York.
The system’s operator, Colonial Pipeline, said in a statement late Friday that it had shut down its 5,500-mile pipeline, which carries 45 percent of the east coast’s fuel supplies, to contain the attack on its computer networks. There was disruption along the pipeline earlier on Friday, but it was unclear whether this was a direct result of the attack.
Colonial’s pipeline transports 2.5 million barrels daily, transporting refined gasoline, diesel fuel, and jet fuel from the Gulf Coast to New York Harbor and major New York airports. Most of it goes to large storage tanks, and since the pandemic has dampened energy consumption, the attack was unlikely to cause immediate disruption.
In the statement, the company said it learned on Friday that it was “a victim of a cybersecurity attack,” but did not provide details. Such an attack could be malware that terminates its operation or ransomware that requires payment to unlock computer files or systems.
“In response, we have proactively taken certain systems offline to contain the threat that has temporarily halted all pipeline operations and impacted some of our IT operations,” the company said regarding information technology systems.
It said it contacted law enforcement and other federal agencies. The FBI is leading such investigations, but critical infrastructure is the responsibility of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency.
The breach comes just months after two major attacks on American computer networks – the penetration of SolarWinds by the main Russian intelligence agency and another attack on a Microsoft email service attributed to Chinese hackers – that illustrate the vulnerability of the networks where the government operates and businesses rely.
While both of these attacks were initially aimed at stealing email and other data, the nature of the intrusions created “back doors” that experts say could ultimately allow attacks on the physical infrastructure. So far, it is believed that none of the efforts resulted in anything other than data theft.
The Biden government announced sanctions against Russia for SolarWinds last month and is expected to issue an executive order in the coming days that will take measures to secure critical infrastructure, including calling for more security for providers providing services to the federal government.
The United States has long warned that Russia implanted malicious code on power grids, and the United States responded a few years ago by injecting similar code into the Russian grid.
However, actual attacks on energy systems are rare. About a decade ago, Iran was blamed for an attack on the computer systems of Saudi Aramco, one of the world’s largest manufacturers, in which 30,000 computers were destroyed. This attack, which appeared to come in response to the US-Israeli attack on the Iranian nuclear centrifuges, had no effect on operations.
Another attack on a Saudi petrochemical plant in 2017 nearly triggered a major industrial disaster. But it was quickly closed, and investigators later attributed it to Russian hackers. That year someone briefly took control of a water treatment plan in a small Florida town in what appeared to be an attempt to poison the supply, but the attempt was quickly stopped.
