A ransomware attack against the company that transports much of the fuel to the U.S. East Coast created a crisis extending threats far beyond the company itself. Colonial Pipeline has been doing a good job of communicating how it’s responding. It’s a positive example of keeping people updated on a negative situation.

Fingers are pointing to a hacker group called DarkSide for shutting down the IT system of the Alpharetta, Georgia-based company. Colonial Pipeline reportedly carries 45 percent of the East Coast’s fuel supply. In response, regulations were loosened, including on the number of hours truckers can drive. But that can’t make up for the shortfall. Gasoline prices have risen amid retail panic buying.

In a statement posted at 12:30 p.m. Saturday, May 8, Colonial Pipeline said it learned of the ransomware attack the day before. In response, it took certain systems offline, which halted its pipeline operations. It also hired a cybersecurity firm and notified law enforcement as it continued to investigate. It said its focus was on returning to normal operations.

The company provided a longer update at 5:10 p.m. the next day. It now said all pipeline operations were only “temporarily halted” and it was working to restore its IT systems. “Over the past 48 hours, Colonial Pipeline personnel have taken additional precautionary measures to help further monitor and protect the safety and security of its pipeline,” the company wrote.

More Details

The company wisely provided more details without getting too technical. It said that its four main lines remained offline, but some smaller ones were now operating. It would “bring our full system back online only when we believe it is safe to do so.”

It also tweeted out a link to the statement, though for some reason didn’t post it on its Facebook page. It would have been better to tweet the full statement because, at times during the week, its website has been inaccessible.

Colonial Pipeline updated again on Monday at 12:25 p.m. (all the updates are on the same web page as the original message). “While this situation remains fluid and continues to evolve, the Colonial operations team is executing a plan that involves an incremental process that will facilitate a return to service in a phased approach,” it wrote.

It provided further updates Monday night (one of its four main lines was flowing again) and Tuesday night (it had increased aerial patrols of its pipeline). And then the biggest news: At 5:10 p.m. Wednesday the company announced that it had initiated the restart of its pipeline operations. The end (of the crisis) is near.

Colonial Pipeline was fairly diligent in supplying what people need most in a crisis: information. Reading its at-least-daily updates, we got the sense the situation was being addressed in an all-hands-on-deck manner and progress was being made. On the negative side, as far as we can tell no company executives were out front in the media giving interviews. While they were clearly busy, doing so could have helped reassure the public even further.

Photo Credit: Colonial Pipeline

Sign up for our free weekly newsletter on crisis communications. Each week we highlight a crisis story in the news or a survey or study with an eye toward the type of best practices and strategies you can put to work each day. Click here to subscribe.