Ransom at the Valve: Colonial Pipeline, RedEcho and the Defence of India's Energy Chain

B.A.P-I Retrospective, 2020 to 2024. This paper looks back at 2021 and the lesson it holds for the protection of India's critical infrastructure.

1. Introduction

The year 2021 offered two warnings about the energy chain within the space of three months. The first came from the United States in May, when a ransomware attack on Colonial Pipeline halted the movement of fuel along the American East Coast and produced panic buying in more than a dozen states. The second came at the end of February, when a private threat intelligence firm reported that a China-linked group had been targeting organisations in the Indian power sector, and the Ministry of Power was able to state that India's national agencies had already detected the threat, issued alerts and secured the affected control centres. Read together, with five years of hindsight, the two episodes say a good deal about how energy networks are attacked in the cyber age, and about how India can build on what its institutions got right.

2. Colonial Pipeline: An IT Breach That Stopped the Fuel

Colonial operates a pipeline of some 5,500 miles that delivers about 45 per cent of the East Coast's fuel supply (CBS News, 2021, Jun. 8). The attack, attributed to the DarkSide group and executed on 7 May 2021, forced the company offline "in an abundance of caution to contain the ransomware attack" (Industrial Cyber, 2023, May 8). Testifying before the Senate Homeland Security and Governmental Affairs Committee, the company's chief executive explained that the intruders had entered in late April through a compromised account on the company's virtual private network, an account that lacked multi-factor authentication; the decision to pay roughly $4.3 million in bitcoin was taken on 7 May and executed the following day (CBS News, 2021, Jun. 8). The United States Justice Department later seized 63.7 bitcoins, then valued at about $2.3 million, from the payment (Global News, 2021, Jun. 7).

The significance of Colonial lies less in the sophistication of the intrusion, which was modest, than in the shape of the consequence. A single stolen credential on a business network was enough to stop the physical flow of fuel to a large part of a national economy, because the operator could not be confident of the boundary between its business systems and its operations. One finds here the defining feature of cyber-physical risk: the attacker need not touch a valve if the owner will close it for him.

The American response was swift and, notably, regulatory. On 27 May 2021 the Transportation Security Administration issued a security directive requiring covered pipeline operators to report cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency within 12 hours, to designate a cybersecurity coordinator available around the clock, and to complete a vulnerability assessment within 30 days (Mayer Brown, 2021, Jun. 2). Two years later the agency's own account of what had been learnt placed its emphasis on operational collaboration with pipeline operators and on a model in which "the default is to share information on malicious cyber activity" (Industrial Cyber, 2023, May 8). A voluntary, sector-driven model had, in one stroke, been supplemented by binding obligations.

3. India's Grid: An Early Warning That Worked

India's official position on the episode came first and was clear. The Ministry of Power stated that the Indian Computer Emergency Response Team (CERT-In) had alerted the Power System Operation Corporation as early as 19 November 2020 to the ShadowPad threat at some of its control centres, and that the National Critical Information Infrastructure Protection Centre (NCIIPC) had written on 12 February 2021 about a group targeting Regional and State Load Despatch Centres. All the indicated IP addresses and domains were blocked at the firewalls of the control centres, systems were scanned and cleaned, monitoring was in place at the regional and national despatch centres, and the Ministry stated that "No data breach/ data loss has been detected due to these incidents" (Indian Defence News, 2021, Mar. 2). The Power Minister added that two teams had examined the Mumbai outage of October 2020, one concluding that it was not caused by a cyber attack and the other finding that, while cyber attacks had occurred, they were not linked to the grid failure, which he attributed to human error (Deccan Herald, 2021, Mar. 2).

The private report to which the Ministry was responding came from Recorded Future, which said that a group it named RedEcho had targeted ten Indian organisations in the power generation and transmission sector and two in the maritime sector, using infrastructure associated with ShadowPad, a backdoor it described as used by at least five distinct Chinese groups (Recorded Future, 2021, Mar. 1). The sequence matters. India's own agencies had seen the threat months before the foreign report, acted on it and contained it without loss of data or supply. That is the national early warning system working as designed, and it is the foundation on which further protection should be built.

Hindsight confirms that the threat was persistent. In April 2022 Recorded Future claimed that a further group had likely targeted at least seven State Load Despatch Centres in North India, as well as a national emergency response system (Recorded Future, 2022, Apr. 6); researchers described the gathering of information on India's energy systems as "likely a long-term strategic priority" for some Chinese state-sponsored actors (Riley, 2022, Apr. 7). The same month, Oil India Limited reported a ransomware attack on a workstation at its field headquarters at Duliajan in Assam, with a reported demand of $75,00,000; the company stated that drilling and production were unaffected, though its online systems were down (Business Today, 2022, Apr. 14). Both kinds of threat that 2021 had displayed, criminal extortion and state-linked reconnaissance, were thus present around India's energy chain, and in both cases core operations continued.

4. The Energy Chain as One System

The lesson for India is that oil, gas and power cannot be protected as separate verticals. Crude moves from ports to refineries by pipeline; products move to depots and city gas networks; refineries and compressor stations draw on the grid; the grid is balanced from load despatch centres whose own continuity depends on telecom and on fuel for backup generation. A Colonial-style compromise of a pipeline operator's business network, or a RedEcho-style foothold in a despatch centre, propagates along these dependencies. India has built strong institutions for each part of this chain: CERT-In for incident handling, NCIIPC for critical information infrastructure, sectoral computer emergency response teams, and separate regulators for electricity and petroleum. The natural next step is a mechanism that assesses and exercises them as one chain, which is the convergence problem this Institute identified at the start of 2021 between infrastructure protection and internal security management (Dash, 2021, Jan. 22).

The power sector has moved decisively. In October 2021 the Central Electricity Authority issued its first cyber security guidelines for the power sector, binding on all utilities and requiring procurement of information and communication technology from identified trusted sources or testing for malware and hardware trojans before deployment (Power Line, 2021, Oct. 8). In October 2025 the Authority published draft regulations that would require every entity to designate a chief information security officer, physically isolate operational technology from information technology networks, report incidents to the sector's response team within six hours and undergo an annual cyber security audit (Power Line, 2025, Oct. 8). These are sound measures for so far as electricity is concerned, and they offer a ready template for the pipeline, refinery and city gas networks that share the grid's dependencies but are governed by other instruments.

5. Protect the Chain, Not the Silo: Recommendations

Three recommendations follow from the record. First, India should extend to the oil and gas midstream the binding framework that the power sector is now adopting, with mandatory segregation of operational systems, multi-factor authentication on all remote access and a short reporting window, so that an operator facing ransomware can isolate its business network without stopping product flow. Colonial demonstrates that the decision to shut down is the real point of failure, and that decision should be planned and rehearsed in advance. Second, the energy chain should be exercised as a whole: joint drills that place a pipeline operator, a refinery, a load despatch centre and their respective response teams in a single scenario would test the dependencies that sectoral audits cannot see. Third, the model of 2021, in which CERT-In and NCIIPC detected, alerted and contained, should be institutionalised as a standing energy-chain threat intelligence cell that serves the power, petroleum and gas sectors together, with a single authoritative channel for public communication after any incident.

The year 2021 showed the world that a ransomware gang could stop a nation's fuel, and showed that India's agencies could detect and contain a sophisticated intrusion attempt on its grid before it did harm. The task now is to extend that capability from the grid to the whole energy chain, so that oil, gas and power are defended as the single system they are.