Fed recovers millions in ransomware payments from Colonial Pipeline hackers

Federal authorities have recovered more than two million dollars in cryptocurrency paid in ransom to foreign hackers whose attack last month led to the shutdown of a major pipeline that provides nearly half the East Coast’s fuel, according to officials.© Mark Kauzlarich/Bloomberg Storage tanks at a Colonial Pipeline Inc. facility in Avenel, N.J. on May 12.

The seizure of funds paid by Colonial Pipeline to a Russian hacker ring, DarkSide, marks the first recovery by a new ransomware Justice Department task force. It follows a string of cyber attacks that panicked consumers and led President Biden to warn Russia that it needed to take “decisive action” against the criminal networks.

“Today we turned the tables on DarkSide,” Deputy Attorney General Lisa Monaco said, announcing the recovery on Monday afternoon. “The Department of Justice has found and recaptured the majority of the ransom” in the wake of last month’s attack.

Colonial Pipeline CEO Joseph Blount told The Wall Street Journal last month that the firm paid $4.4 million in ransom.

“I know that’s a highly controversial decision,” he said. “ … But it was the right thing to do for the country.”