Ransomware halts Colonial Pipeline operations: Update

Adds company statement on ransomware and pipeline details.

Operations along Colonial's Pipeline's 5,500-mile (8,851km) system, the main artery between US Gulf coast refineries and New York Harbor, remain shut as a precaution after the company experienced a ransomware attack yesterday.

The company notified shippers at 12:37pm ET on 7 May that the pipeline system was being impacted by network issues and this afternoon confirmed a cybersecurity breach that involved ransomware. Ransomware is malicious software that blocks access to a computer system until a ransom is paid.

To contain the threat, Colonial said it took some systems offline, which has temporarily halted all pipeline operations and has also affected the nominating system that facilitates requests to ship petroleum products on the pipeline.

Colonial's pipeline system transports about 2.5mn b/d, or more than 100mn USG/d, of gasoline, diesel, jet fuel, home heating oil and other oil products from 30 refineries in Texas, Louisiana and Mississippi to markets in the southeast and eastern seaboard up to New York Harbor. Gasoline injected in Pasadena, Texas, normally takes 18-21 days to reach Linden, New Jersey.

Colonial did not give an expected time of return to full operations but said a third-party cybersecurity team is investigating the nature and scope of the attack. The company said it contacted law enforcement and is cooperating with the investigation.

Colonial's 5,500 miles of petroleum product pipelines include two main lines and 65 stub lines supplying markets along the route. The system carries 15-20pc of US oil product pipeline shipments and nearly 40pc on the east coast, making it the world's largest liquid petroleum products pipeline by volume, according to the company.

Warnings about the pipeline industry's exposure to cyber attacks have been ringing for years. A February 2017 study sponsored by engineering group Siemens found that the deployment of cybersecurity measures in the US oil and gas industry was not keeping pace with the growth of digitization in operations.

After a 2018 attack on Latitude Technologies' EDI system — a third party service used for pipeline scheduling and nominations — at least four companies that own interstate natural gas pipelines advised customers to temporarily switch to other systems. That cyber attack did not disrupt physical pipeline operations.

Enterprise Products Partners in 2019 said it had "doubled down" on cybersecurity, boosting investment in its internet technology group to address the rising threat to pipeline systems.

The security of the country's oil, gas and hazardous liquid pipelines is overseen by the US Transportation Security Administration's (TSA), and some in government have debated whether the TSA is the right agency for the job.

New York Harbor RBOB prices rose this week to $2.15/USG, a two-year high, amid a possible unplanned gasoline unit outage at Phillips 66's 250,000 b/d Bayway refinery in Linden.

Prompt gasoline shortages were exacerbated by slow shipments from the US Gulf coast on the Colonial pipeline even before the cyber attack. While the arbitrage was open on paper, most shipments on the pipeline continued to be diverted to locations south of New York Harbor.

However, transatlantic gasoline loadings from Europe hit the highest level since summer 2019 during the last week of April. These cargoes, scheduled to arrive in New York Harbor in first-half May, will likely relieve any lingering shortage.

The diesel arbitrage into New York Harbor was closed on paper but jet was narrowly open last week.

By Jason Metko