The attack on Colonial Pipeline (COLPI.UL) is one of the most disruptive digital ransom schemes reported and the resulting shutdown has disrupted fuel supply across the eastern United States, triggering isolated sales restrictions at retail pumps and pushing benchmark gasoline prices to a three-year high.
A news release issued on Monday in the name of the cyber group DarkSide, the group suspected of the attack on the pipeline, said “our goal is to make money, and not creating problems for society.” Its statement did not mention Colonial Pipeline by name.
Lawmakers urged stronger protections for critical U.S. energy infrastructure, and the White House has made restarting the fuel network a top priority and organized a federal task force to assess the impact and avoid more severe disruptions.
While the U.S. government investigation into the attack is in its early stages, a former U.S. official and three industry sources said the hackers are suspected to be a cybercriminal group called DarkSide. Cybersecurity experts said the group appears to be composed of veteran cybercriminals focused on squeezing as much money as they can from their targets.
The southeastern United States would likely be the first to see price increases at retail pumps, and demand has already picked up as drivers fill their tanks. The southeast is the most dependent on the line and has fewer alternatives than states further north, and has seen prices spike during previous shutdowns.
Gas stations in southeastern states such as Georgia, North Carolina and Tennessee were seeing some abnormal buying, fed by demand fears, said Patrick De Haan, head of petroleum analysis at GasBuddy.
“My biggest concern, as far as the consumer goes, is that you end up with a run on the gasoline supplies at the gas station, further exacerbating what is happening at the terminals,” said Andrew Lipow, president of consultants Lipow Oil Associates LLC.
Colonial said on Sunday it restarted some smaller lines between fuel terminals and customer delivery points but its main lines remained shut. It did not provide a timeline for a full restart of the 5,500 mile (8,850 km) system.
The pipeline system is the primary fuel artery from Gulf Coast refineries to Mid-Atlantic and southeast states. It moves over 2.5 million barrels per day (bpd) of gasoline, diesel and jet fuel, supplying motorists and major airports.
The Department of Transportation announced emergency measures on Sunday to facilitate deliveries, lifting driver restrictions on fuel haulers in 17 states affected by the shutdown. It could take additional measures if the outage continues.
Traders provisionally booked at least six tankers to ship gasoline from Europe to U.S. destinations following the attack. Two European gasoline traders, however, said the market was taking a cautious approach to see how long the shutdown would last.
The line supplies jet fuel to major airports including the busiest in the country, Hartsfield-Jackson International in Atlanta. The airport expects the outage to be resolved before any impact on flights, a spokesman said.
An alternative, smaller conduit that serves the same region has already filled. Kinder Morgan Inc’s (KMI.N) 720,000-bpd fuel pipeline had been working with customers to take on additional volumes since Friday and reached full capacity for May on Sunday, a spokeswoman for the company said.
If the disruption stretches on, fuel suppliers would need to use trucks and rail to transport fuel to compensate.
“Extended downtime at Colonial would severely impact refined product supply to the high-density East Coast, a region with just 818,000 bpd of refining capacity but 5.3 million bpd of current demand,” said investment bank Tudor, Pickering, Holt & Co in a note.
Gulf Coast refiner Valero Energy (VLO.N) chartered a tanker to store fuel offshore that it is unable to pump through the pipeline, and other refiners were looking to do the same, market participants said.