Things are starting to return to normal for Colonial Pipeline who got pwned by ransomware by an Eastern European based group of hackers. This in turn caused gas stations to start to run out of gas yesterday. And here’s the reason why things are getting back to normal. They paid the hackers according to Bloomberg:
Colonial Pipeline Co. paid nearly $5 million to Eastern European hackers on Friday, contradicting reports earlier this week that the company had no intention of paying an extortion fee to help restore the country’s largest fuel pipeline, according to two people familiar with the transaction.
The company paid the hefty ransom in untraceable cryptocurrency within hours after the attack, underscoring the immense pressure faced by the Georgia-based operator to get gasoline and jet fuel flowing again to major cities along the Eastern Seaboard, those people said. A third person familar with the situation said U.S. government officials are aware that Colonial made the payment.
Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that the company continued using its own backups to help restore the system, one of the people familiar with the company’s efforts said.
A representative from Colonial declined to comment, as did a spokesperson for the National Security Council.
I have always said that you shouldn’t pay scumbags like these as it only encourages them to do more attacks like this. Here’s a few more reasons why you shouldn’t pay up:
The FBI discourages organizations from paying ransom to hackers, saying there is no guarantee they will follow through on promises to unlock files. It also provides incentive to other would-be hackers, the agency says. Such guidance provides a quandary for victims who have to weigh the risks of not paying with the costs of lost or exposed records.
So while this news is disappointing, it isn’t surprising. These sorts of things are a business decision at the end of the day. Which means that companies should focus on defending themselves from these sorts of attacks so that they don’t have to make these sorts of decisions.

HelpSystems Acquires Agari
Posted in Commentary with tags HelpSystems on May 13, 2021 by itnerdHelpSystems announced today the acquisition of Agari, a recognized leader in enterprise solutions protecting against advanced email threats. Agari has seen notable growth with its Software as a Service (SaaS) offering, which sets the standard for protecting organizations against phishing, business email compromise, and email threats. In light of today’s complex security environment and increased cybercrime, this is a key capability for organizations in all industries, which is why HelpSystems continues to focus on enhancing its data security suite via adjacent acquisitions.
Despite the growth in cyberattacks through other vectors, email remains the most common channel for costly data breaches and cybercrime. Agari solutions detect, defend against, and respond to email attacks by using massive data sets, data science, and the power of cloud computing.
Agari was a founding member of the industry consortium that developed the Domain Message Authentication Reporting & Conformance (DMARC) email authentication standard. This critical initiative enables organizations to authenticate email from their domains to prevent cybercriminals from impersonating their brand, helping them protect their customers and partners from email attacks.
In connection with this transaction, JMP Securities LLC served as financial advisor to Agari, and Cowen served as financial advisor to HelpSystems.
HelpSystems is a software company focused on helping exceptional organizations Build a Better IT™. Our cybersecurityand automation software simplifies critical IT processes to give our customers peace of mind. We know IT transformation is a journey, not a destination. Let’s move forward. Learn more at www.helpsystems.com.
Agari is the Trusted Email Identity Company™, protecting brands and people from devastating phishing and socially-engineered attacks. Using applied data science and a diverse set of signals, Agari protects the workforce from inbound business email compromise, supply chain fraud, spear phishing, and account takeover-based attacks, reducing business risk and restoring trust to the inbox. Agari also prevents spoofing of outbound email from the enterprise to customers, increasing deliverability and preserving brand integrity. Learn more at agari.com.
Leave a comment »