Colonial pipeline restarts after cyberattack but fuel curbs to linger

(Bloomberg) — The largest fuel pipeline in the U.S. restarted its entire system after a cyberattack nearly a week ago, but said it will take several days for the supply chain to return to normal.

Colonial Pipeline Co. has started delivering products like gasoline, diesel and jet fuel to all of the markets it serves, the pipeline operator said in a statement on Thursday, but some areas may experience service interruptions during the restart process. The system, which transports products from Gulf Coast refineries as far north as New York, is running at less than half of capacity, according to people familiar with the matter.

Earlier, it emerged that the operating company paid almost $5 million in untraceable cryptocurrency to Eastern European hackers last week to help get gasoline and jet fuel flowing again along the Eastern Seaboard. Fuel shortages from Florida to Virginia continue and Colonial said its system is about 5.5 days behind its current schedule.

In a message to filling stations, U.S. President Joe Biden said in a White House briefing on Thursday, “Do not -- I repeat, do not -- try to take advantage of consumers during this time.”

Despite the resumption of operations, disruption persists in large parts of the Eastern and Southern U.S. as motorists contend with fuel shortages, and it’s likely to be days before normal supplies are returned to normal. President Joe Biden urged Americans “to just purchase what they need, and not hoard fuel, as supply is restored,” Press Secretary Jen Psaki said in a statement Thursday.

“Resumption of flows is the start, but the race to logistically replenish retail gas stations is the next step,” said Michael Tran, an analyst at RBC Capital Markets. “The restarting of the Colonial pipeline is the beginning of the end of the crisis, not the end.”

In an effort to provide relief, the Biden administration temporarily waived century-old shipping restrictions to allow one foreign-flagged ocean-going tanker to help relieve the shortages. Still, the sailing time alone for a ship to take fuel from Houston to New York would be six or seven days.

Gasoline stations ran dry from Florida to Virginia after Colonial was forced to take systems offline on May 7. In parts of the U.S. South, three in every four gas stations had no fuel as of Wednesday, while in Washington, D.C., cars were lining up for blocks as they waited to fill up.

Optimism that the situation will start returning to normal sent benchmark gasoline futures down as much as 3.1% in New York trading. Earlier in the week, pump prices soared above $3 a gallon for the first time in six years.

The administration temporarily issued a waiver to the 101-year-old Jones Act for one unidentified company. The act stipulates goods transported between U.S. ports be carried on ships built in the U.S. and crewed by American workers.

Widespread waiving of the requirements could allow foreign-flagged tankers to help fill the supply gap left by the interruption to the pipeline. The initial waiver is for one tanker although more are under consideration, a White House official said. Typical cargo deliveries into the U.S. East Coast are about 300,000 barrels.

Earlier this week, the White House announced several other measures to blunt the crisis, including waiving some gasoline requirements and empowering 10 states to allow heavier-than-normal truck loads of fuels.

Despite the improved outlook, the disruption underscores just how vulnerable America’s fuel supply system has become in the wake of increased attacks on energy infrastructure by hackers over the past few years. Colonial is only the latest example of critical infrastructure being targeted by ransomware. Hackers are increasingly attempting to infiltrate essential services such as electric grids and hospitals.

The attack on Colonial also came just as the nation’s energy industry is preparing for summer travel and as fuel demand rebounds from pandemic-related lockdowns. It was reminiscent of a 2018 cyberattack that brought down a third-party communications system used by several natural gas pipelines operators across the U.S.

Colonial normally ships about 2.5 million barrels (105 million gallons) each day, an amount that exceeds the entire oil consumption of Germany. The pipeline’s operator warned the line may go down again from time to time during the restart process.

In a separate bulletin to its shippers, it also said the company was physically starting operations before its business systems -- which process nominations for space on the pipeline and schedule them -- are back up and running. As a result, Colonial will be using schedules that were set five days ago until its systems are back in service, the notice shows.

Feeling Relief

As the pipeline resumes, the states suffering from the most acute shortages may start to feel relief this weekend.

In North Carolina, some fuel supply should appear right away, said Gary Harris, executive director of the North Carolina Petroleum & Convenience Marketers, a trade association. “People will have to be running trucks a lot to just catch up because so much is out at this time,” he said.

Major branded stations will get fuel first as they are under contract with suppliers, said Harris. Fuel may still be scarce for independent stations that are not under contract.

Royal Dutch Shell Plc said it was pursuing alternative supply points, where possible, and working in close coordination with wholesalers to address supply and logistical challenges.

In Virginia, consumers should be able to see a difference by Monday, said Michael O’Connor, president of the Virginia Petroleum & Convenience Marketers Association.

This isn’t the first time Colonial has been forced to shut down. In 2016, an explosion kept the system offline for days, raising gasoline prices and forcing the New York Harbor market to become more dependent on imports of fuel from overseas.

The Federal Bureau of Investigation attributed the attack on Colonial to ransomware created by a group called DarkSide. Some evidence emerged linking DarkSide to Russia or elsewhere in Eastern Europe. Biden said Russia has “some responsibility” to address the attack but stopped short of blaming the Kremlin, saying “there’s evidence” the hackers or the software they used are “in Russia.”