COLONIAL PIPELINE, an American fuel carrier, said on May 8th that it had been the victim of a cybersecurity attack, forcing the firm to shut down its 5,500-mile (8,850km) pipeline, which transports petrol, diesel and jet fuel from the Gulf Coast to America’s east coast. The company said the shutdown was only a precaution. The attack, which occurred two days earlier, was reportedly carried out by DarkSide, a ransomware group thought to be based in Russia or elsewhere in the former Soviet Union. The group—which is known for imitating legitimate businesses, for example by issuing press releases and offering victims customer service—took almost 100 gigabytes of data from Colonial’s corporate networks and threatened to leak it onto the internet unless the firm paid a ransom, according to Bloomberg. FireEye, a cyber-security firm, is investigating the incident.
Such attacks are becoming more common. Even as rates of most crimes remain low in rich countries, cyber-crime—crime committed mostly or entirely by digital means—is on the rise. That includes internet fraud, identity theft and ransomware attacks, like the one suffered by Colonial, where victims’ files are locked up until money is paid. Such attacks were once crude. Ransomware arrived in spam emails and targeted ordinary people’s computers. The sums demanded were often small to encourage people to pay up.
These days hackers focus on large organisations and demand big ransoms (see chart). Malicious software is injected into specific computer systems. It steals data before locking them. A ransom is then demanded to unlock the files or, increasingly, to prevent them from being leaked. The demand is almost always for payment in Bitcoin, which cyber-criminals prefer to traditional currency because it is liquid and relatively anonymous. Chainalysis, a cyber-security firm, says the amount paid in Bitcoin ransoms increased by 311% last year compared with 2019, to around $350m. Victims are usually businesses but increasingly include governments and their departments, including the police.
The damage is enormous. NotPetya, a widespread ransomware attack in 2017, is estimated to have cost companies more than $3bn. Ransoms can be eye-watering: an attack in March on the Broward County school system, which includes Fort Lauderdale in Florida, came with a demand for $40m in Bitcoin. In messages leaked by the hackers, one of the district’s negotiators was incredulous: “You cannot possibly think we have anything close to this.” But the consequences of not paying can be just as costly. In 2019 an attack on the City of Baltimore cost its taxpayers $18m, including $10m in direct costs to the city’s information-technology office and $8m in lost or delayed revenue.
Colonial has not said whether it plans to pay the ransom. And it remains to be seen what the costs of the attack will be….