Colonial Pipeline said late Wednesday that after learning of the May 7 ransomware attack it took its pipeline system offline and did everything it could to restart it - before deciding to pay the money.
Chief executive Joseph Blount told The Wall Street Journal he authorized the payment because the company didn't know the extent of the damage and didn't know how long it would take to restore the pipeline's systems.
"I know that's a highly controversial decision," Blount said. "I didn't make it lightly. I will admit that I wasn't comfortable seeing money go out the door to people like this. "But it was the right thing to do for the country," he said.
The U.S. Federal Bureau of Investigation warns against paying money to ransomware attackers because doing so facilitates criminal networks around the world that have targeted thousands of companies and health care systems in the U.S. in the last year alone.
However, some victims of attacks - in which hackers demand money to decrypt stolen data or keep it from being released online - choose to pay.
Blount said Colonial paid the ransom after consulting with experts who had worked with DarkSide, the company allegedly behind the attacks, which rents out its ransomware to partners to carry out the actual attacks.
Several sources confirmed to The Associated Press that Colonial Pipeline paid the cybercriminals a ransom of nearly $5 million in cryptocurrency for the software decryption key needed to unscramble its data network.
According to Tom Robinson, joint founder of cryptocurrency monitoring company Elliptic, a ransom payment of 75 Bitcoin was made the day after the criminals locked up Colonial's corporate network. Two people briefed on the case confirmed the payment amount to The Associated Press before Robinson's blog post.
Blount told The Journal the attack was discovered about 5.30 a.m. May 7, and it took Colonial about an hour to shut down the pipeline - which has 260 distribution points spanning 13 states and Washington, D.C. This helped to keep the infection from spreading to the pipeline's operational controls.
DarkSide was apologetic for causing so much trouble - despite the fact that they eventually got what they wanted.
"Our goal is to make money and not create problems for society," the group said in a statement.
Fox News host Sean Hannity Thursday criticized U.S. President Joe Biden for the situation: "Joe's cowardly response to Russia's hack of the Colonial pipeline is beyond embarrassing. It is also self-destructive. Not only did Biden give Vladimir Putin a free pass on Russians hacking the Colonial pipeline, but then five days later, get this, Joe rewarded his pal, Vladimir, by removing Trump-era sanctions on what was a key Russian pipeline that helps our allies in Germany and elsewhere in Europe."
