Colonial Pipeline reports data breach after May ransomware attack

Colonial Pipeline, the largest fuel pipeline in the United States, is sending notification letters to individuals affected by the data breach resulting from the DarkSide ransomware attack that hit its network in May.

The company says that it "recently learned" that DarkSide operators were also able to collect and exfiltrate documents containing personal information of a total of 5,810 individuals during their attack.

Impacted personal info for the affected individuals ranges from names and contact details to health and ID information.

"The affected records contained certain personal information, such as name, contact information, date of birth, government-issued ID (such as Social Security, military ID, tax ID, and driver's license numbers), and health-related information (including health insurance information)," Colonial Pipeline reveals in the data breach notification letters.

However, as the pipeline system's CEO and President Joseph A. Blount, Jr. adds, not all of this information was stolen for each impacted individual.

DarkSide forced Colonial Pipeline to shut down

The DarkSide ransomware gang hit the networks of Colonial Pipeline, which supplies roughly half of all the fuel on the US East Coast, on May 6 (according to breach information filed last week).

During the incident, DarkSide operators also stole roughly 100GBs of files from breached Colonial Pipeline systems in about two hours, according to sources close to the investigation.

Colonial Pipeline said it was forced to shut down its entire infrastructure to contain the threat after the attack. However, the media reported at the time that the actual reason behind the shutdown was the company's inability to bill customers after the incident.

"On May 7, the Colonial Pipeline Company learned it was the victim of a cybersecurity attack," the company told BleepingComputer. "In response, we proactively took certain systems offline to contain the threat, which has temporarily halted all pipeline operations, and affected some of our IT systems."

Colonial Pipeline's shutdown was followed by the Department of Transportation's Federal Motor Carrier Safety Administration (FMCSA), declaring a state of emergency in 17 states and the District of Columbia.

The DarkSide ransomware gang abruptly shut down their operation after the group saw increased levels of attention from both media and the US government and law enforcement.

Their decision to stop operations came after Colonial Pipeline paid $4.4 million worth of cryptocurrency for a decryptor, most of it later recovered by the FBI.

From DarkSide to BlackMatter

However, less than two months later, a new ransomware operation known as BlackMatter emerged, purchasing network access from other threat actors to launch attacks against corporate victims, with ransom demands ranging from $3 to $4 million.

Emsisoft CTO and ransomware expert Fabian Wosar confirmed that the Salsa20 encryption algorithm found in a decryptor shared by BleepingComputer was previously only used by DarkSide, and now BlackMatter.

"After looking into a leaked BlackMatter decryptor binary I am convinced that we are dealing with a Darkside rebrand here," Wosar said.

"Crypto routines are an exact copy pretty much for both their RSA and Salsa20 implementation including their usage of a custom matrix."

The notorious DarkSide ransomware gang, now rebranded as BlackMatter, is actively attacking corporate entities but says it won't target the "Oil and Gas industry (pipelines, oil refineries)," which previously attracted much-unwanted attention and forced them to rebrand.