Colonial Pipeline Hack Unveils Risk of Cyberattacks | Barita Insights | May 17, 2021

Background

The Colonial Pipeline, operated by the Colonial Pipeline Company, is the largest pipeline system for refined oil products in the US. On Saturday, May 8th, 2021, the Company released a statement, confirming reports that ransomware hackers hacked into its network and disrupted the flow of refined oil to end-users. This marks the largest cyberattack that has hit the US Energy system in history as the Colonial Pipeline services approximately 45% of the fuel utilized by the US’ East Coast. According to the US government, the cyberattack was carried out by an organized crime group called “Darkside” and later reports indicate that the company paid the ransom of US$5 million. The recent attack highlights the vulnerability of key assets, not just in the US, but for many countries and companies globally. This brings to the fore the pivotal role cybersecurity plays in a digital world. In this article, we look at the implications of the Colonial Pipeline shutdown and how this event has shone a light on the growing threat of cyberattacks.

Panic Induced “Shortage”

Now, following the reports of the pipeline hack, consumers flooded gas stations to hoard gasoline. The natural implication from this was an increase in gas prices as supply tanked and demand skyrocketed. In truth, however, this was a “knee-jerk reaction” as the US’ gasoline inventory as of May 7, 2021, was sufficient to last 26.5 days as reported by the Wall Street Journal. Essentially, the “shortage” was panic-driven as motorists pre-emptively decided to fill up; thereby creating shortages at the pumps while the system, on a whole, had more than enough stored gasoline. Notably, while the restoration was gradual, as of Saturday, May 15th, the company has confirmed that its entire system has returned to normal operations.

Jamaica

Locally, Petrojam has reported that Jamaica’s gas supplies remain sufficient. Notwithstanding, local gas prices have increased quite quickly, reflective of the price increase witnessed in the US. General Manager of Petrojam, Winston Watson, indicated that while the shortage in the US has not affected Jamaica’s gas supplies, price increases in the US also affect Jamaica. This comes on the back of already heightened prices which have been increasing almost continuously since the start of the year. Specifically, between December 31, 2020, and May 13, 2021, the price of “Gasolene 87” and “Gasolene 90”, as reported by Petrojam, have increased by 34%. Importantly, this uptrend in prices has also been seen in Pretrojam’s reference price, the US Golf Coast Spot Price, which has increased by 51% between December 31, 2020, and May 10, 2021.

The Larger Issue

The cyberattack on Colonial has unearthed the fact that many companies have been victims of ransomware and related cyberattacks. However, most companies stay silent and pay the ransom to keep things quiet. The recent attack, however, has been a major catalyst for new efforts in Congress to require critical companies to inform the government once they’ve been hacked. Even Republicans have indicated support for cybersecurity regulations; a stark contrast to their position on the last effort to pass meaningful cybersecurity legislation. This, we believe is a key point; if cyberattacks are not reported then investigations are not conducted. This, in effect, fuels more ransomware as hackers are essentially paid to continue what has become a highly paid illicit activity. This issue flows well beyond the borders of the US and has implications globally. Specifically, ransomware cost is estimated to total US$20 billion in 2021, 57 times more than it was in 2015 (rapid growth), as reported by Cybercrime Magazine. More broadly, cybercrimes are estimated to inflict damages amounting to US$ 6 trillion in 2021 – a sum that dwarfs the GDP of Japan.

Concluding Thoughts

The recent attack on the Colonial Pipeline demonstrates the severity of cyberattacks. Moreover, it has brought to the fore, the fact that many companies that have been victims of cyberattacks typically pay ransoms, and in many cases, these incidents go unreported. Therefore, the costs of these attacks are embedded in the income statements of many companies and are borne by shareholders who are completely unaware. Further, the financial implication of cyberattacks represents just one aspect of the loss as companies can suffer severe, irreversible reputational damages depending on the specific circumstance surrounding the attack. Therefore, as the US is now doing, more countries will need to strengthen regulations surrounding cybersecurity to protect shareholders and stakeholders, particularly now, as digitization intensifies, and the fourth industrial revolution materializes.