WILMINGTON, N.C. — A two-pump gas station on the North Carolina coast, EZ Mart 1 LLC, is representing more than 11,000 gas stations in a class-action lawsuit aimed at Colonial Pipeline.
The pipeline, the nation’s largest, was forced to shut down May 7 by a gang of hackers calling themselves DarkSide. The shutdown caused long lines at fuel pumps as some panicked consumers created the gasoline shortage they were attempting to avoid by draining gas stations in the Southeast of their supplies. The pipeline restarted May 12 and is currently operating at capacity.
The lawsuit in the U.S. District Court for the Northern District of Georgia alleges that Colonial “should have known” of the dangers of a ransomware attack and failed to take the proper steps to safeguard its critical infrastructure against cyberattacks. EZ Mart’s attorneys also claim that gas station owners “ran out of gasoline to sell to their customers and suffered a loss of revenue” due to the pipeline shutdown. Wilmington, N.C.-based EZ Mart sold the last of its fuel on May 12 and was unable to fill its tanks again until May 21, according to court documents.
Colonial had “a duty toward the gas station and convenience-store customers who were dependent upon [it] maintaining cybersecurity, thereby barring application of the economic loss rule,” the lawsuit said. “Oil and gas products are a critical national resource and [the] defendant holds an effective monopoly and a bottleneck over that resource. Under the circumstances, Colonial had a duty to maintain the supply of fuel to gas stations, whether it wanted to or not, and suspended pipeline operations to the detriment of [the] plaintiff and those similarly situated at its peril. By engaging in the business of supplying fuel to more than 11,000 gas stations and adopting a critical role in national security and essential infrastructure, and reaping the monetary benefits thereof, [the] defendant voluntarily assumed a special and independent duty to take reasonable measures to ensure the continued and uninterrupted supply of fuel to the gas stations that relied on such supply.”
In addition to the loss of gasoline sales, EZ Mart “saw inside sales drop precipitously,” the court documents said. Because of the attack and resulting fuel shortage, EZ Mart’s sales for May of $76,185 fell by $7,789 compared to sales for April of $83,974, “even though the EZ Mart is located on a busy thoroughfare outside a popular coastal city and May is the beginning of tourist season.”
DarkSide likely broke into Colonial’s system using a virtual private network account password, according to a Bloomberg report. While it’s unclear how the hackers obtained the password, Bloomberg noted that multifactor authentication, a basic cybersecurity tool, might have stopped the hackers.
“While we cannot comment on pending litigation, Colonial Pipeline worked around the clock to safely restart our pipeline system following the cyberattack against our company,” a spokesperson from Alpharetta, Ga.-based Colonial Pipeline said in a statement provided to the news agency.
The lawsuit claims Colonial Pipeline was negligent in its cybersecurity and seeks a judge’s order finding the company’s online security measures inadequate and in need of correction.
The proposed class action was brought by the Rhine Law Firm in Wilmington as well as attorneys with Morgan & Morgan, Wallace & Graham PA and Hall & Green Law.
Members help make our journalism possible. Become a CSP member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.