Cybersecurity Attack Halts GA-Based Gas Pipeline Operations

ALPHARETTA, GA — Alpharetta-based Colonial Pipeline Company was the victim of a cybersecurity attack on Friday, forcing a shutdown of its operations across the United States.

Colonial Pipeline is "the largest refined products pipeline in the United States, transporting more than 100 million gallons of fuel daily to meet the energy needs of consumers from Houston, Texas to the New York Harbor," according to its website. The company has customers and markets throughout the southern and eastern United States through a pipeline system that spans more than 5,500 miles. Roughly 45 percent of all fuel consumed on the east coast comes from the Colonial Pipeline, providing products to more than 50 million Americans.

Monday afternoon, Colonial Pipeline said it takes time to restore the network to normal operations. While the situation remains fluid and continues to evolve, the Colonial operations team is creating a plan to return service in incremental phases.

"This plan is based on a number of factors with safety and compliance driving our operational decisions, and the goal of substantially restoring operational service by the end of the week," Colonial Pipeline said Monday afternoon.

On Sunday night, the company posted an update saying, "quickly after learning of the attack, Colonial proactively took certain systems offline to contain the threat. These actions temporarily halted all pipeline operations and affected some of our IT systems, which we are actively in the process of restoring. Leading, third-party cybersecurity experts were also immediately engaged after discovering the issue and launched an investigation into the nature and scope of this incident."

In a statement on its website, the company said it has determined the incident involved ransomware.

Colonial has been in contact with law enforcement and other federal agencies, including the Department of Energy which is leading the federal government response.

On Monday, the FBI confirmed the Darkside ransomware is responsible for the attack. Darkside posted online that its goal was money.

"Maintaining the operational security of our pipeline, in addition to safely bringing our systems back online, remain our highest priorities," Colonial Pipeline said on Sunday. "Over the past 48 hours, Colonial Pipeline personnel have taken additional precautionary measures to help further monitor and protect the safety and security of its pipeline."

The Colonial Pipeline operations team is now developing a system restart plan.

"While our mainlines (Lines 1, 2, 3 and 4) remain offline, some smaller lateral lines between terminals and delivery points are now operational," the company said on Sunday. "We are in the process of restoring service to other laterals and will bring our full system back online only when we believe it is safe to do so, and in full compliance with the approval of all federal regulations."

Potential Gas Shortage

The incident could cause shortages and affect fuel prices in Georgia if the closure continues a couple more days, one expert said.

The Federal Motor Carrier Safety Administration declared an emergency in response to the "unanticipated shutdown" of the Colonial pipeline.

Industry experts say the attack will affect gas prices only if the pipeline is shut down for more than five days.

"The challenges brought on by the Colonial Pipeline shut down would likely not appear for several days or longer," said Patrick De Haan, a fuel analyst with GasBuddy. "My guess is they'll be able to restart the pipeline before any major issues develop. This should NOT be a pricing event- but this may be a supply event."

De Haan added, "If it lasts more than five days or so, there would be challenges in some SE states only, but they may not all be even across the affected states."

Once the pipeline restarts, it will take days for normal conditions to occur. It's difficult to pin the exact amount prices may rise, De Haan said, but for now, it appears to be a few cents per gallon, possibly growing more significant if the pipeline remains shut down for more than two to three more days.

The affected states and territories also include Alabama, Arkansas, District of Columbia, Delaware, Florida, Georgia, Kentucky, Louisiana, Mississippi, New Jersey, New York, North Carolina, Pennsylvania, South Carolina, Tennessee, Texas and Virginia.

According to GasBuddy data, Sunday gasoline demand in Georgia, North Carolina, South Carolina, Tennessee and Virginia was nearly at the same level as Friday, but slightly lower than Saturday. "Some level of abnormal buying is occurring at retail," De Haan tweeted.

Patch Editor Tom Davis and Deb Belt contributed to this report.