A recent "ransomware" attack on a U.S. company's pipeline, which interrupted gasoline supplies in Southeastern states, shows how vulnerable our country's energy infrastructure is to hackers. It also shines light on criminal gangs that sell expertise in computerized mayhem to the highest bidder. Cybersecurity experts say groups like DarkSide, a Russian-affiliated organization believed to be behind this month's Colonial Pipeline, sell or rent their hacking software or services to those who hold data hostage until victims pay ransom. Similar disruptions have hit banks, factories, hospitals and a few local governments.

That type of intrusion led Colonial, based in Alpharetta, Ga., on May 7 to shut 5,500 miles of pipeline carrying 45 percent of East Coast fuel. Gasoline began flowing about a week later after the firm says it paid $4.4 million to the extortionists. "This should be a wake-up call," warns Boston energy industry consultant Jonathon Monken of Converge Strategies. "When you look at what's most likely to cause disruptions to energy companies today, I think you have to put cybersecurity risks at the top." Yet New York Times coverage says that "despite years of warnings, America's vast network of pipelines, electric grids and power plants remains acutely vulnerable to cyberattacks with the potential to disrupt energy supplies for millions of people."

Ransomware has been around for a decade and expanded in the last several years with the rise of cryptocurrencies such as bitcoin that are difficult to trace and can be transferred electronically without government-regulated banks. The U.S. government has "strong reason to believe" those behind the pipeline attack are in Russia, President Biden says, though he doesn’t believe Moscow leaders directed the assault. Still, he urged President Vladimir Putin to “take decisive action” against them. The Justice Department, he said, would step up prosecutions of ransomware hackers and the government will "pursue a measure to disrupt their ability to operate."

Pipeline executive says: "It [payment] was the right thing to do for the country. I didn't make it lightly. I will admit that I wasn't comfortable seeing money go out the door to people like this." – Joseph Blount, Colonial Pipeline chief executive, to The Wall Street Journal

Security executive says: "In an ideal world, the government would prohibit paying ransoms. … The problem is, we don't live in an ideal world." – Jen Ellis, vice-president at Rapid7, a Boston computer security firm

Industry consultant says: “"It [ransomware] is a marketplace that involves services, products and goods. It's like eBay." -- Mark Arena, chief executive of Intel471, a cybercrime intelligence firm in Texas