I think parent may mean infrastructure side. If it had just attacked the office side of things, it would be the usual 'company infected with ransomware' story without affecting the public.
Yes, it's guesswork and pretty extreme conjecture but it has just the right amount of coldheartedness to it: https://zetter.substack.com/p/biden-declares-state-of-emerge...
> New details from within Colonial Pipeline have come to light surrounding the decision to shut off supply. Those briefed on the matter have suggested that fuel flows were shut down due to the company's billing system being compromised. Company officials were reportedly concerned that they would not be able to accurately bill customers for fuel delivered, and chose to stop delivery instead.
It’s a privately financed, constructed and operated pipeline. I don’t see why they should be obligated to operate without getting paid.
Who's been messin' up everything...
Colonial obviously have done well in certain ways: their business side and operational side are decoupled. Business side got hit with a major IT problem - and the damage was contained. Pipelines kept working as intended. That's good operational planning, and they deserve credit for it. They were perfectly capable of, quite literally, keeping the lights on for 100M people.
> It’s a privately financed, constructed and operated pipeline. I don’t see why they should be obligated to operate without getting paid.
Because they are critical infrastructure. Colonial are entitled to their profits as long as they keep their side of the bargain: supply oil and fuel for those 100M people who critically depend on them.
This is where role of a regulation comes in. Make it the critical supplier's responsibility to ensure that they supply. If they lose their billing capability, that's their problem. Not their customers'.
(Oh shit, everything just went down, turn on the generator, go plug that printer and laptop in, and print off all the reports of where we were from the offsite/offline/whatever backup).
What did they do before computers?
Failing to plan is planning to fail and all.
I like the idea of monthly planned downtimes where possible so people don’t run around like a headless chicken when things go down. No different than a fire drill.
If they did, I would expect their employees to be out of practice with such methods since they weren't working that way day-to-day. Unless they're running regular "all computers are down"-drills to keep their employees sharp, downtime was probably inevitable.
I've long wondered if that really was the case, seemed absolutely sensible...
In truth both factors probably played a role in this case, perhaps also with a hefty dose of "our software literally can't run if billing is down because it was never designed to handle that".
> After Colonial Pipeline reported that its corporate computer networks were hit by the ransomware attack, the company shut down the pipeline as a precaution due to a concern that the hackers might have obtained information allowing them to carry out further attacks on vulnerable parts of the pipeline.