NEW YORK – The cyberextortion attempt that has forced the shutdown of a vital U.S. pipeline was carried out by a criminal gang known as DarkSide that cultivates a Robin Hood image of stealing from corporations and giving a cut to charity, a person close to the investigation said Sunday.
The shutdown, meanwhile, stretched into its third day, with the Biden administration saying an “all-hands-on-deck” effort is underway to restore operations and avoid disruptions in the fuel supply.
Experts said that gasoline prices are unlikely to be affected if the pipeline is back to normal in the next few days but that the incident – the worst cyberattack to date on critical U.S. infrastructure – should serve as a wake-up call to companies about the vulnerabilities they face.
The pipeline, operated by Georgia-based Colonial Pipeline, carries fuel from Texas to the Northeast. It delivers roughly 45% of fuel consumed on the East Coast, according to the company.
It was hit by what Colonial called a ransomware attack, in which hackers typically lock up computer systems by encrypting data then demand a large ransom to release it. The company has not said what was demanded or who made the demand.
However, the person close to the investigation, speaking on condition of anonymity, identified the culprit as DarkSide. It is among ransomware gangs that have “professionalized” a criminal industry that has cost Western nations tens of billions of dollars in losses the past three years.
DarkSide claims it does not attack medical, educational or government targets and it donates a portion of its take to charity. It has been active since August and, typical of the most potent ransomware gangs, is known to avoid targeting organizations in former Soviet bloc nations.
Colonial did not say whether it has paid or was negotiating a ransom, and DarkSide neither announced the attack on its dark website nor responded to an Associated Press reporter's queries. The lack of acknowledgment usually indicates a victim is either negotiating or has paid.
The person close to the investigation said the attackers also stole data from the company, presumably for extortion purposes. Sometimes stolen data is more valuable to ransomware criminals than the leverage they gain by crippling a network, because some victims are loath to see sensitive information of theirs dumped online.