Major U.S. fuel supplier Colonial Pipeline offline following ransomware attack

Major U.S. fuel supplier Colonial Pipeline offline following ransomware attack

On May 7, major U.S. fuel supplier Colonial Pipeline fell victim to a ransomware attack that caused the company to temporarily shut down its 5,500-mile pipeline operations. Though the hackers did not reach the network that controls the physical infrastructure to transport fuel, the company went offline as a safety precaution. Colonial Pipeline carries its products from the U.S. Gulf Coast to the East Coast and provides 45 percent of the East Coast’s supply of diesel, gasoline, and jet fuel.

Colonial Pipeline system

Pipeline operation taken offline by cyber criminals

While most operations remain offline, the U.S. government has declared an emergency order which allows fuel carriers to drive more overtime hours on less sleep until the June 8 expiration date. Nearly 10,000 trucks are hauling fuel across the country each day to supplement the pipeline losses. Sources report on May 12 that U.S. federal regulators have expanded waivers under the pipeline relief program to include less strict summer fuel requirements. This includes lifting the low gasoline volatility requirements under the federal Clean Air Act, which takes effect between June 1 to September 15. The waivers will only apply to transportation in twelve Eastern states and the District of Columbia.

On the night of May 10, Line 4, which runs from Greensboro, NC, to Woodbine, MD, was restored to service under manual control for a limited period. As of May 12, the main lines remain shut. The date of restart remains unknown, leaving fuel consumers and major infrastructure in the South and on the East Coast in uncertainty. In a public statement, Colonial Pipeline has cited its intent of restoring most operations before the end of the week. As this must be done within the parameters of labor safety and environmental compliance, the feasibility of the timeline remains uncertain.

The author of the ransomware attack is a Russia-based cyber-criminal gang called DarkSide, who infiltrated Colonial Pipeline’s network and took almost 100GB of data hostage, demanding a ransom for its release. The cyber-gang threatened to leak the information publicly if the ransom was not paid. The attack surface was likely greater due to the remote work that the COVID-19 pandemic has necessitated, leaving companies like Colonial Pipeline vulnerable to malicious actors. This ransomware attack reinforces one of the top 5 predictions made by Everstream Analytics in its 2021 Annual Report on risks to prepare for.

Colonial Pipeline announced that an investigation into the apparent vulnerability has been launched and that the restoration of their IT systems is underway. Although its four main lines remain offline, some smaller lateral lines between terminals and delivery points are now operational.

Limited alternative transport options for fuel

Though the emergency declaration by the U.S. government loosens restrictions for ground carriers, this is set against the backdrop of a national shortage of tanker truck drivers amid the COVID-19 pandemic. In comparison to pipelines, fuel transport by road and rail are possible but are much less efficient. With decreased capacity and lengthy travel times, these alternative options do little to quell localized shortages. Fuel transport by rail, while historically the primary transport mode for the petroleum industry, is a costly alternative. On average, it costs between USD 10-15 per barrel to transport oil and gas by rail compared to USD 5 per barrel by pipeline.

Some parts of the U.S., such as the Florida peninsula, can receive fuel shipments by barge from producers along the U.S. Gulf of Mexico. However, transport by barge tends to be more costly, moving less volume and taking longer to load and offload. The Jones Act, a U.S. maritime regulation that requires shipping between U.S. ports to use vessels that are built, owned, and operated by American companies, also complicates this form of transport. Barges are considered vessels under the guidelines of the regulation. The strict nature of these guidelines is likely to mean that approved vessels available for the domestic shipment of oil is limited. Sources report on May 12 that the Biden Administration is considering a temporary waiver of domestic shipping restrictions under the Act. Sources indicate that all vessels on the Gulf Coast that are approved to ship refined petroleum products between U.S. ports have been booked since the pipeline went offline. A temporary waiver would expand shipment capacity, a critical support when considering that one-third of Jones Act-qualified vessels are non-operational due to the economic strains of the COVID-19 pandemic.

Air cargo hubs at risk of fuel shortages

The Colonial Pipeline carries 2.5 million barrels per day (bpd) and runs from Pasadena, TX, near Houston, to the New York Harbor (NYH) area. It supplies key infrastructure, including major air cargo hubs. The pipeline directly serves seven airports, including some of the busiest international airports in the area that rely on jet fuel supplies, such as Hartsfield-Jackson Atlanta and Charlotte Douglas. The Hartsfield-Jackson cargo terminal, with a capacity of 16 cargo carriers and over 2 million square feet of cargo handling space, is the primary hub for Delta Air Lines and hosts cargo traffic for more than 30 regional and international airlines. Sources reported on May 9 that the Colonial Pipeline shutdown has not yet affected flight operations at either of the above airports, though this is subject to change based on the duration of the operational stoppage. The COVID-19 pandemic led to the decreased global fuel demand by roughly 30 million bpd in 2020. In the U.S., the demand for jet fuels had decreased by 75 percent from June 2019 to June 2020. Industry sources project that, even now in the context of a rapid vaccination campaign, jet fuel consumption will not revert to pre-pandemic levels until roughly 2030. Because of this, potential fuel shortages resulting from the pipeline stoppage are not anticipated to be as impactful on airfreight operations as they might have been in a different context.

Some airlines have still taken precautionary measures to avoid the worst. American Airlines has added stops on some long-haul flights to save fuel at its second-largest hub, adding a fuel stop in Dallas in transit from Charlotte to Honolulu, Hawaii. Southwest Airlines has begun carrying extra fuel into airports with limited supply, such as Nashville, to reduce refueling on the ground and supplement local supplies. Both airlines have reported that these measures will be lifted on May 15. Other airlines, like Delta and United, have not reported any disruptions yet. Atlanta Hartsfield-Jackson Airport authorities have stated that they are seeking arrangements with alternative jet fuel suppliers as a safeguard. Delta Airlines is also known to operate its own oil refinery in Trainer, Pennsylvania.

Gulf Coast refineries bear the brunt

The shutdown of a major fuel supplier may lead to higher prices. According to sources, the price of crude oil and refined petroleum products spiked on May 10 after the pipeline shutdown. The impact of the attack and subsequent shutdowns depend on how long the pipeline will remain offline. Some suggest that one to two days of outage would cause minimal disruption, but greater impacts are expected should the stoppage exceed five days. In that case, refiners will be forced to reduce their production rates, which could drive up the cost of crude oil.

Some of the Gulf Coast’s major refineries have already begun to feel the impacts of the pipeline shutdown. Oil and gas producer Motiva Enterprises LLC has already cut production at its Port Arthur, TX plant by 45 percent, shutting two crude distillation units and a reformer. Similarly, Total SE reduced gasoline production on May 10 at its 225,500-bpd refinery. Most terminals along the pipeline should have at least 10-15 days of fuel supply, however, a shutdown beyond this could lead to substantial shortages.

Nearly 1,000 gas stations in the southeast have already run out of gasoline as motorists hoard fuel while supplies start to tighten in the region. An industry source indicated on May 11 that gas stations in Georgia and other southeastern states are selling two to three times their normal amount of fuel. Sources report that nearly 8 percent of gas stations in Virginia and North Carolina no longer have gas supply, more reflective of panic consumption rather than an actual shortage. In addition, gasoline prices on the East Coast are expected to see a further increase above USD 3 per gallon in the coming weeks leading up to Memorial Day as more motorists travel after being vaccinated against the coronavirus.

Looking ahead

The reverberating disruptions of the winter freeze that hit Texas in February 2021 may exacerbate the impacts of the Colonial Pipeline shutdown. Many oil and gas facilities along the Gulf Coast had declared force majeure on production during this storm, some of which have not yet lifted such orders. Refineries owned by ExxonMobil in Baytown and Beaumont, Texas had been adversely impacted by the freezing conditions and the lack of natural gas supply across the state. Plains All American Pipeline had declared force majeure on more than a dozen of its crude pipelines and gathering systems in Texas, some of which have not yet resumed normal operations. This is likely to accelerate the depletion of supply while Colonial Pipeline remains offline. The Colonial Pipeline incident, much like the February winter storm, has exposed the vulnerabilities of U.S. energy infrastructure to a wide range of risks. Some of these risks, such as severe weather events, can be mitigated through the advanced preparation of infrastructure. Others, such as the latest ransomware attack, are less predictable. Yet, it is apparent that the mitigation of IT network disruptions is critical.

The latest disruption has also taken place during the “shoulder” season, a period between the winter peak heating season and the summer peak cooling season. The shoulder season is often the time of year when maintenance work takes place at nuclear plants, refineries, and natural gas processing plants. While such planned maintenance periods are considered normal, highly anomalous weather phenomena — such as above or well below normal temperatures — can stress the system. At least into the latter portion of May, there is no indication of this occurring to levels that would further strain production activities.

However, the attack comes right at the start of the tropical storm season, which runs between June and November. The Everstream Analytics Applied Meteorology team anticipates above-average tropical storm activity in the Atlantic Basin this year, meaning that any adverse weather conditions may further exacerbate supply shortages. Weather-related disruptions in the coming month affecting refineries, including at distillates such as gasoline, heating oil, propane, or natural gas processing facilities, will compound the effects of the Colonial Pipeline ransomware attack. In 2020, when Tropical Storm Laura, followed by Hurricane Delta, hit the U.S. Gulf Coast and forced oil & gas companies to shut down several facilities, 92 percent of total crude oil production and 62 percent of natural gas output in the Gulf of Mexico were taken offline.

How companies can prepare

Monitor updates to the resumption of operations. Those with business interests reliant on the continuity of pipeline transport should keep abreast of changes to the operational status of the four main lines and the smaller, ancillary lines. Everstream Analytics will continue to keep close track of company announcements and updates detailing advancements or setbacks in the recovery of Colonial Pipeline’s network operations. As the duration of the production stoppage is a critical determinant to the severity of the subsequent supply chain impact, Everstream Analytics will report on such changes in near-real time.

Stay informed of policy changes impacting fuel transport and supply. Though Colonial Pipeline is a private company, the U.S. government has already taken steps to demonstrate its willingness to use emergency orders to support alternative methods of fuel transport. In the event of a long-term pipeline shutdown, government-issued orders will play a critical role. For instance, the Jones Act can be voided when deemed a national emergency, mitigating some of the challenges of barge transport. Likewise, the U.S. can temporarily increase fuel imports from Canada and Mexico to alleviate the strain on domestic supply on the East Coast. Everstream Analytics will continue to monitor and report on such regulatory announcements as soon as the information is made public.

Seek alternative aviation fuels or increase imports. Should the pipeline remain offline by the end of this week, those with air freight interests at vulnerable airports should consider seeking alternative sources of jet fuel. Alternative jet-fuel blending agents for flights have utilized feedstocks from plants, plant and animal oils, biogas or biomass, and conversion of sugars derived directly from plants or from hydrolyzed biomass. Further, jet fuel imports from Canada and Mexico can be temporarily increased to ease the shortages faced by critical international airports on the East Coast. Should the pipeline outage continue beyond this week, organizations are advised to consider the opportunities and impacts of seeking such alternatives.

Share this post

2022 Annual Supply Chain Risk Report – Top 5 SCRM Risk Trends

Build a better supply chain this year. Let Everstream provide you with the predictive insights and analytics to turn your supply chain into a business-changing, market-shifting, competition-crushing asset.

To learn about the top 5 supply chain risk trends in 2022, download the Annual Risk Report today.