Colonial Pipeline attack
A May 2021 ransomware attack that led the operator of the main US East Coast fuel pipeline to shut it down as a precaution, a textbook case of voluntary shutdown and of a political response to a criminal loss.
On May 7, 2021, the operator of the Colonial pipeline, about 5,500 miles between the Gulf of Mexico and the New York area, found DarkSide ransomware in its business systems, though the industrial systems running the pipeline were not themselves encrypted. It nonetheless shut down the entire network as a precaution for five days, causing fuel shortages in several states. The case became a textbook example for three reasons. It shows that cyber business interruption can arise from the insured's own decision rather than an outage, hence the voluntary shutdown extensions now negotiated in policies. It shows that a criminal attack on vital infrastructure triggers a state response, here mandatory security directives for pipelines and a court seizure of part of the ransom, which moves it from crime news into public policy. And it was handled as an ordinary criminal act because no government attributed it to a state, a reminder that the characterization of a loss depends on an act outside the contract.
The operator paid 75 bitcoins, about 4.4 million dollars, the day after the attack. On June 7, 2021, the US Department of Justice announced it had seized 63.7 of those bitcoins, then worth about 2.3 million dollars because the price had fallen.
Colonial Pipeline attack, Colonial Pipeline ransomware, DarkSide 2021
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.