Top US Fuel Pipeline, Crippled By Ransomware Attack, Days Away From Restart

America's biggest gasoline pipeline is unlikely to resume significant operations for several days due to a ransomware cyberattack that Washington on Monday blamed on a shadowy criminal network called DarkSide.

The attack on the Colonial Pipeline between Houston and New Jersey, which provides nearly half the fuel to the US East Coast, is one of the most disruptive digital ransom schemes ever reported.

The privately owned company on Monday said it was working on re-starting in phases with "the goal of substantially restoring operational service by the end of the week."

The FBI attributed the cyberattack to DarkSide, a group cyber experts say may be based in Russia or Eastern Europe. Its ransomware targets computers that do not use keyboards in the languages of former Soviet republics, they said.

But US President Joe Biden said there was no evidence so far that Russia was involved in the attack.

"So far there is no evidence based on, from our intelligence people, that Russia is involved, although there's evidence that the actors' ransomware is in Russia," Biden said.

A statement in the group's name said, "Our goal is to make money, and not creating problems for society." Its statement did not mention Colonial Pipeline by name.

Ransomware is a type of malware designed to lock computers by encrypting data and demanding payment to regain access. It is unknown how much money the hackers are seeking, and Colonial has not commented on whether it would pay.

Anne Neuberger, deputy national security adviser for cybersecurity, told reporters that the Biden administration is not offering advice on whether Colonial should pay the ransom.

Colonial on Friday voluntarily shut its 5,500-mile pipeline network, which moves fuels including gasoline, diesel and jet fuel, to protect its systems. The closure triggered fears of retail gasoline price spikes, shortages and travel disruption.

The episode laid bare the vulnerabilities of energy infrastructure to hackers. US lawmakers responded with calls for stronger protections for critical energy infrastructure.

A spokesman for United Nations Secretary-General Antonio Guterres said the attack showed that UN member states needed to combat cybercrime to avoid "devastating impact on the world that we all live in."

Colonial restarted some smaller lines on Sunday between fuel terminals and customer delivery points. But its main lines remained shut, and an alternative, smaller conduit owned by Kinder Morgan serving the same region reached capacity.

This has created concerns in energy markets ahead of the summer vacation season, when gasoline demand and airline travel tend to peak.

PAIN AT THE PUMP?

Fuel demand in the southeastern United States has already picked up as consumers fear shortages. Gas stations in states such as Georgia, North Carolina and Tennessee were seeing some abnormal buying, said Patrick De Haan, head of petroleum analysis at GasBuddy.

The American Automobile Association said the national gasoline price average climbed 6 cents on the week to $2.96 a gallon, the highest since May 2018.

In East Atlanta, Georgia, Marcus Blash, the owner of a small trucking company, worried when he heard the news of the pipeline shutting down. His company doesn't have any ability to store fuel on site to hedge against prices.

"We pay at the pump," he said. "It hasn't hit us yet, but this is going to hurt big time."

If the disruption stretches on, fuel suppliers could ship by trucks and rail instead. The Department of Transportation announced emergency measures on Sunday, lifting driver restrictions on fuel haulers in 17 states affected by the shutdown.

US fuel importers are also booking at least six tankers to ship gasoline from Europe to US destinations following the attack.

Total SE reduced gasoline production on Monday at its 225,500 barrel-per-day Port Arthur, Texas, refinery because the pipeline shutdown left it without a way to ship the gas, sources said.

(This story has not been edited by NDTV staff and is auto-generated from a syndicated feed.)