Thoughts at large

[Jimaz]

I think I heard this right but maybe not.

The recent gasoline shortages on the east coast were caused by a ransomware attack on a pipeline company. The crooks encrypted the company's files and withheld the decryption key until the ransom was paid. The company paid the $5M ransom but the decryption process was so slow that they restored their files from backup copies instead.

Um, if they had backups, why did they bother paying the ransom at all?

What did I miss?

The reason they paid the ransom despite having backups might be that it was part of a sting operation.

US recovers millions in cryptocurrency paid to Colonial Pipeline ransomware hackers

US investigators have recovered millions in cryptocurrency they say was paid in ransom to hackers whose attack prompted the shutdown of the key East Coast pipeline last month, the Justice Department announced Monday....

Colonial Pipeline Co. CEO Joseph Blount told The Wall Street Journal in an interview published last month that the company complied with the $4.4 million ransom demand because officials didn't know the extent of the intrusion by hackers and how long it would take to restore operations.

But behind the scenes, the company had taken early steps to notify the FBI and followed instructions that helped investigators track the payment to a cryptocurrency wallet used by the hackers, believed to be based in Russia....

"When Colonial was attacked on May 7, we quietly and quickly contacted the local FBI field offices in Atlanta and San Francisco, and prosecutors in Northern California and Washington D.C. to share with them what we knew at that time. The Department of Justice and FBI were instrumental in helping us to understand the threat actor and their tactics. Their efforts to hold these criminals accountable and bring them to justice are commendable," Blount said....

To inoculate an operation against ransomware, a good backup policy needs to be executed and the backup files need to be stored offline. Consider it insurance. If hackers encrypt your files, the most you lose will be the transactions made since the most recent backup.