One Week After JBS Cyberattack, U.S. Feds Recover Ransom Paid By Colonial Pipeline Via Blockchain

One week after a cyberattack shut down meat packing plants in three countries, the U.S. Justice Department announced federal officials successfully seized $2.3 million of the cryptocurrency payment that was made during the Colonial Pipeline hack less than a month earlier. According to news first reported by CNN, U.S. investigators have recovered millions of dollars in cryptocurrency that Colonial Pipeline paid hackers last month to end a ransomware attack on its systems.

During an interview with the Wall Street Journal last month, Colonial Pipeline’s Chief Executive Joseph Blount said he knew the decision to pay $4.4 million in ransom to the Russian hacking group was controversial, but he said he did so because “it was the right thing to do for the country” since they weren’t certain how long the attack would last.

Deputy Attorney General Lisa Monaco confirmed Monday that Federal officials seized 63.7 Bitcoins, now valued at about $2.3 million, in a recovery operation after the Colonial Pipeline attack took its toll on the nation’s gasoline infrastructure, impacting gas supplies all along the East Coast.

After the payment was made in bitcoin, reports say the ransom recovery is a rare outcome for a company that suffers a ransomware cyberattack. A warrant published Monday shows authorities were able to recover the funds through software called blockchain explorer. The warrant said the software uses API and blockchain nodes to draw data from blockchain in a searchable format. That allowed authorities to search for and review the transaction for any addresses on a particular blockchain, including the ones used to pay the ransom via bitcoin.

Last week’s worldwide cyberattack on JPS also caught the attention of the White House. The White House said Brazil's JBS SA informed the U.S. government the ransomware attack against the company originated from a criminal organization likely based in Russia, a theory White House Press Secretary Jen Psaki confirmed during a press briefing last week.

“Obviously ransomware attacks, we've seen them increase over a period of time. It's an increasing threat to the private sector and to our critical infrastructure and there are other countries, many of whom we will see when the president is in Europe, who have similar concerns, so we expect this to be an issue of discussion,” said White House Press Secretary Jen Psaki last week.

The JBS issue was resolved in a matter of days, as the majority of JBS packing plants were back online by mid-week. JBS has not said if the company paid ransom in order to get the plants back online.