Sources: cybercrime gang DarkSide, which caused Colonial Pipeline to halt operations, stole and encrypted ~100GB of data on Thursday before demanding a ransom
- Attackers stole nearly 100GB of data in two hours on Thursday — Theft followed by locking of computers and ransom demand
Context & Ripple Effects
Colonial Pipeline had already halted operations after the ransomware attack, making the incident an immediate continuity problem for a conduit that related coverage says carries a large share of East Coast fuel. The new account establishes that DarkSide paired the shutdown with data theft, rather than relying on encryption alone.
DarkSide subsequently portrayed itself as financially motivated and said it would moderate targets, while later reporting said the group lost access to its servers and funds. Those developments frame the attack as both a high-impact extortion event and a challenge to the gang’s ability to operate.
First-order effects
- Colonial must address both encrypted systems and the exposure of roughly 100GB of stolen data while restoring operations after the ransomware-driven shutdown.
- DarkSide gains two sources of pressure in its ransom demand: unavailable systems and possession of Colonial data.
Second-order effects
- The operational outage threatens fuel supply in the Southeast and East Coast, increasing the urgency of Colonial’s restoration and ransom decisions.
- Colonial’s reported ransom payment turns the attack into a visible test of whether critical-infrastructure operators can avoid paying when attackers combine theft with encryption.
Third-order effects
- The incident points to ransomware shifting toward dual-extortion campaigns, in which data exfiltration preserves leverage even after a victim restores systems.
- For critical-infrastructure operators, remote-access weaknesses become an operational-continuity risk when a single intrusion can interrupt physical service as well as expose data.
The trend: Ransomware groups are increasingly pairing data theft with system encryption to raise the cost of resisting extortion, especially for operators whose outages affect essential services.