Colonial Pipeline's customer communications system back online after experiencing problems

Houston — Colonial Pipeline's communications system for shippers came back online late May 18 after experiencing problems for most of the day, again disrupting operations even though the petroleum products artery is up and running again after being halted for nearly a week following a cyberattack.

Refined products shippers were unable to make nomination changes on Colonial for most of the day, despite the line resuming normal operations May 13, sources said.

Colonial halted all pipeline operations May 7 because of a ransomware attack, restricting the primary artery for gasoline and refined products from delivering more than 100 million gal/d of fuels. Colonial stretches more than 5,500 miles from the Houston refining hub to New York Harbor, supplying about 45% of all the gasoline and diesel fuel consumed on the East Coast.

A combination of regional shortages and panic-buying caused 50% or more of gas stations in North Carolina, South Carolina, Georgia, Virginia, Florida, and Washington to run out of fuel, and some regional shortages were continuing May 18.

"Colonial has restored service to our nominations system, and customers can once again place nominations," Colonial said in a statement after 1900 GMT.

"Our internal server that runs our nomination system experienced intermittent disruptions this morning due to some of the hardening efforts that are ongoing and part of our restoration process. These issues were not related to the ransomware or any type of reinfection," Colonial said earlier. "The Colonial Pipeline system continues to deliver refined products as nominated by our shippers."

Gulf Coast CBOB was last heard at NYMEX RBOB futures minus 13.90 cents/gal for deliveries on Colonial Pipeline's 30th cycle, 20 points above the last close. Market indications for CBOB deliveries on the 31st cycle, which starts scheduling May 19, suggest prices at least 25 points above the 30th cycle.

Product typically moves through the pipeline at 3-5 mph.

S&P Global Platts Analytics expects Northeast gasoline inventories to still fall below five-year lows before rebounding, while Gulf Coast refiners face containment issues due to gasoline product stocks as they await the full pipeline restart.

The Colonial attack comes just as US fuel demand was quickly growing since bottoming out in January from the ongoing coronavirus pandemic, and just ahead of the busy summer driving season.

CYBERATTACK

The cyberattack exposed the particular vulnerability not only of the US' energy infrastructure, but particularly of the pipeline sector that has only voluntary federal guidelines and multiple potential weak points in older technology in more rural field offices.

The ransomware attack impacted Colonial's network and billing operations, leading to the voluntary May 7 shutdown and the reported payment of a $5 million ransom, which has not been confirmed by Colonial.

The DarkSide hacking group identified as the responsible party worked with another unidentified party and said it was shutting down in part from pressure by the US government. The criminal group is believed to be based in Russia, but the White House has said it does not believe the group was working in concert with the Russian government.

The Colonial restart came after the federal government had taken several steps to expedite fuel transportation, including waiving certain fuel standards, eliminating restrictions on truckers' driving hours, and preparing to issue waivers on Jones Act-qualified tankers to move waterborne products.