How a US pipeline came under a cyberattack, how it impacts oil prices

A ransomware attack on a key US pipeline network has led to a disruption in fuel supplies in the eastern part of the United States. Colonial Pipeline Company, which transports about 45 per cent of all petrol and diesel consumed on the east coast of the US was forced to shut down operations after a cyberattack on May 7.

The shutdown led to the US federal government declaring a regional emergency to allow transportation of fuels through tanker trucks to tide over the impact of shortages. What kind of attack was this, and how did it impact oil prices?

What is a ransomware attack?

A ransomware attack is a cyber-attack using malware that encrypts the victim’s files and requires users pay a ransom to decrypt the files.

According to experts, with companies having moved to real-time backups, hackers have, as in the case of the Colonial Pipeline attack, also added the element of downloading all the data on an enterprise network before encrypting it. The hackers can then threaten to leak the data if the ransom is not paid. The US Federal Bureau of Investigation confirmed on Monday that a criminal gang called Darkside was responsible for compromising the Colonial Pipeline network.

How did this attack impact oil prices?

Oil prices rose in response to the attack on Colonial Pipeline, with the price of Brent crude rising to $69 per barrel on Monday before falling to $67.8 on Tuesday.

The Colonial Pipeline company has said that it is restoring operations in a phased manner with the goal of “substantially restoring operations” by the end of the week.

Experts noted that a prolonged shutdown of the operations of the pipeline could push up petrol prices in the US as demand peaks during the summer. The disruption has already led to an uptick in international refining margins, pushing up the price of auto fuels. An increase in the price of petroleum products in Asia could provide a further push to petrol and diesel prices in India, which are already at record high levels. Crude oil prices have risen over the past fortnight despite a surge in Covid-19 infections in Asia due to expectations of increasing crude oil demand from the US and Europe.

How can oil and gas companies deal with such attacks?

Experts noted that there was a need to move towards fortifying approaches to prevent attacks including employing a zero-trust security framework in enterprise networks. “A zero-trust approach means anything is suspected whenever any activity is done on the network, and every user, including the CEO, will have to be verified time and again,” said a cybersecurity consultant who did not wish to be named. This expert added that other measures such as Cloud Access Security Brokers (CPAB), which act as intermediaries between users and cloud service providers, could “give teeth” to an overall cybersecurity strategy.

The expert noted that India’s oil and gas PSUs were making efforts to beef up security, and that organisations managing critical infrastructure such as pipelines and refineries were required by the government to implement certain security measures.

The Ministry of Petroleum and Natural Gas did not respond to emailed requests for comment on the vulnerability of critical oil and gas infrastructure to cyber attacks.