Get the lowdown on ransomware, a hack that has disrupted gas prices and law enforcement

A major fuel pipeline supplying the East Coast was shut down last week after the Georgia-based company operating it became the victim of a ransomware attack. 

And a Russian-speaking ransomware syndicate that stole data from the Washington, D.C., police department says negotiations over payment have broken down, with it rejecting a $100,000 payment, and it will release sensitive information that could put lives at risk if more money is not offered.

Ransomware is malware that infects and locks computer systems until victims pay hackers a fee to unlock them. Hackers typically infect such systems by tricking unwitting computer users into clicking an email attachment or a link containing the virus.

The Colonial hack shouldn't surprise anyone, said Bruce Schneier, a cybersecurity expert and lecturer at Harvard University's Kennedy School of Government.

"This happens hundreds of times a day," Schneier said. "These hackers, this time, just happened to land a big fish."

Cybersecurity experts say two trends are behind the increase in ransomware assaults. The first, they said, was the growth of difficult-to-trace cryptocurrency, which has allowed hackers to easily obtain large ransom payments under the nose of financial regulators.

The FBI on Monday attributed the attack to DarkSide ransomware, which is produced by an eponymous criminal organization that U.S. officials and cybersecurity experts say operates in Eastern Europe or Russia.

DarkSide is a "ransomware-as-a-service" business that relies on selling malware to hackers who then launch attacks and share proceeds with the developers, according to U.S. officials and cybersecurity experts.

The U.S. government is taking steps to address the ransomware threat. The Justice Department last month formed a task force to combat ransomware, and the Biden administration says it is formulating a plan to tackle the problem.

Cybersecurity experts said they expect high-profile hacks like the one on Colonial Pipeline to prod potential victims to heighten security, create backups of data and come up with effective response plans.

The Babuk ransomware group's threat may be the most serious to date, said Brett Callow, a threat analyst and ransomware expert at the security firm Emsisoft.

“This is far worse than any hack of other police departments previously,” Callow said, adding that he's never seen a law enforcement agency pay a ransom before.

A cyberattack on a critical U.S. pipeline is sending ripple effects across the economy, highlighting cybersecurity vulnerabilities in the nation's aging energy infrastructure. The Colonial Pipeline, which delivers about 45% of the fuel used along the Eastern Seaboard, shut down Friday after a ransomware attack by gang of criminal hackers that calls itself DarkSide. Depending on how long the shutdown lasts, the incident could impact millions of consumers.

Colonial Pipeline, the owner, halted all pipeline operations over the weekend, forcing what the company called a precautionary shutdown. U.S. officials said Monday that the "ransomware" malware used in the attack didn't spread to the critical systems that control the pipeline's operation. But the mere fact that it could have done so alarmed outside security experts.

It depends on how long the shutdown lasts. Colonial said it's likely to restore service on the majority of its pipeline by Friday.

There's no imminent shortfall, and thus no need to panic buy gasoline, said Richard Joswick, head of global oil analytics at S&P Global Platts. If the pipeline is restored by Friday, there won't be much of an issue. "If it does drag on for two weeks, it's a problem," Joswick added. "You'd wind up with price spikes and probably some service stations getting low on supply. And panic buying just makes it worse."

The average gasoline price jumped six cents to $2.96 over the past week, and it's expected to continue climbing because of the pipeline closure, according to AAA. Mississippi, Tennessee and the East Coast from Georgia to Delaware are the most likely to experience limited fuel availability and higher prices, and if the national average rises by three more cents, these would be the highest prices since November 2014, according to AAA.

The hackers are Russian speakers from DarkSide, one of dozens of ransomware gangs that specialize in double extortion, in which the criminals steal an organization's data before encrypting it. They then threaten to dump that data online if the victim doesn't pay up, creating a second disincentive to trying to recover without paying.

Ransomware gangs say they are motivated only by profit. 

They're not necessarily at greater risk, but they do pose unique challenges. The Colonial Pipeline structure is a vast piece of critical infrastructure that provides fuel supply to states along the East Coast. Such a large network is bound to have different control systems along its path where it connects with distributors or customers.