- [Narrator] In early May, gas prices,
which were already rising
due to lifted pandemic restrictions shot up.
And it had a lot to do with this.
- The biggest fuel pipeline system in the United States.
- Forced to shut down.
- A suspected cyber attack.
- A cyber extortion attempt.
- [Narrator] On May 7th, the nation's largest fuel pipeline,
Colonial, shut down for six days in response
to a ransomware attack that targeted the company's networks.
- We have efforts underway with the FBI and DOJ,
Department Of Justice, to disrupt them
and prosecute ransomware criminals.
- [Narrator] The attack drove panic consumers
to stockpile fuel, in states heavily impacted
by the shutdown.
Like North and South Carolina, Georgia, and Virginia.
This caused long lines and shortages at gas stations.
The colonial pipeline cyber attack was the latest
high profile event to expose a threat
to aging vulnerable energy infrastructure in the U.S.
So just how vulnerable are we to future attacks?
- Our energy infrastructure is under attack
and has been under attack for at least two decades now.
So both from a physical perspective, but also digital.
- [Narrator] Theresa Payton is a cybersecurity expert
and former White House chief information officer
under the Bush administration.
She says that the energy infrastructure that fuels the U.S.
is highly vulnerable to attacks like this.
The country has around two and a half million miles
of fuel pipelines.
And Colonial is a major part of this network,
stretching from Texas to New Jersey.
Each pipeline includes hundreds of thousands of devices.
Sensors for readings, valves that help control
flow and pressure, and leak detection systems.
Security experts say that all are at risk in an attack.
While most equipment isn't directly
connected to the internet, the concern is that hackers
can penetrate digitized tools or computer networks,
working their way into broader systems.
Cyber criminals will often infiltrate systems
through remote platform hacking, email phishing schemes,
or through compromised employee credentials.
- Once they penetrate IT, they study the traffic
of the accounts on the network,
and they learn how to hide in plain sight.
I liken it to somebody who may be using rush hour traffic
to basically hide their car among hundreds
and thousands of vehicles in rush hour.
It's hard to pick out the bad actor
when they're just kind of going
with the flow of the traffic.
- [Narrator] Once hackers are inside,
they can use malicious code to lock up systems,
or steal sensitive information to extort their victims.
And these type of cyber attacks
can have far reaching effects.
- You have seen after hurricanes, where that has taken
part of our energy infrastructure offline
and sort of what the downstream impacts are
for weeks and months afterwards.
And so a cyber incident can have the same
or even more devastating effects on our energy ecosystem.
- [Narrator] So why are the nation's
most critical energy systems so exposed to cyber crime?
Payton says that as older systems are updated and digitized,
they've become more complex,
which hackers have taken advantage of.
- We're integrating 5G technology, smart grid technology.
Sort of alternative and renewable
sustainable energy sources.
And each time you layer on these new technologies,
these new technologies are unproven,
as far as how they will stand up to a cyber attack.
- [Narrator] In the U.S., there's also high demand
for energy to always be on and working.
Which makes it difficult for systems to be updated.
Replacing outdated systems is also expensive
and time consuming.
But it's not just aging infrastructure
and a lack of resources that expose
energy systems to cyber attacks.
Experts say that hackers are becoming increasingly organized
within the ransomware industry.
- They'll use a combination of burner phones,
dark web forums, using handles in Reddit,
using code words when they're trying to recruit people.
And with more and more Silicon Valley companies
rolling out encryption built in
as part of messaging platforms, it makes it simpler for them
to just use commercially available tools.
- [Narrator] After a successful attack, cyber criminals
can demand payment in cryptocurrency,
which limits the ability of law enforcement to track them.
There's also been a growth in insurance policies
that cover ransomware payments,
which could help boost the illegal industry.
Experts say attacks like the one on the Colonial pipeline
are becoming more frequent.
In 2020 energy companies suffered the third largest number
of cyber attacks of any industry,
up from ninth place the previous year.
But there's only a patchwork of cybersecurity regulations
for energy companies.
And the pipeline sector is largely unregulated.
On May 10th, President Biden said that his administration
was pursuing a global effort to protect American companies
in infrastructure from ransomware attacks.
- It begins with a hundred day sprint
to improve cyber security in the electric sector.
And we'll follow that with similar initiatives
in natural gas pipelines, water, and other sectors.
In addition to companies stepping up, we need to invest
to safeguard our critical infrastructure.
- [Narrator] The colonial pipeline started
to resume operations on May 12th.
but experts say the cyber attack should still serve
as a wake-up call for the energy industry.
(suspenseful music)