US Natural Gas Compression Facility Ransomware Incident (Disclosed 2020)
Volume 2Oil and Gas editionDisclosed 2020Last verified 4 sources, 4 primaryFacility and actor undisclosed
A phishing link on a US gas pipeline's office network let commodity ransomware reach the screens its operators watched. The controllers were never touched. The crew chose to stop, and the pipeline stayed down about two days.
This entry is about the difference between losing control and losing sight. Ransomware reached the HMIs, historians and polling servers on the OT network and caused what CISA calls a partial loss of view. It touched no programmable logic controller, and the operator never lost control. The physical halt was a decision, and a good one: the crew ran a four hour controlled shutdown instead of the immediate one its plan prescribed.
Two ordinary conditions made a phishing email into a two day stop: a path from an inbox to Windows machines on the control side, and no practised way to run without those screens. Neither is a detection failure. In BlastWave's analysis, not a disclosed fact, removing the first keeps the ransomware in the office, and building the second turns a dark screen into a degraded day.
What is not known: No company, government or court has named the operator, the state or the pipeline, and CISA gives no date for the attack. The alert names no ransomware family and no actor; Ryuk comes from a 2019 Coast Guard bulletin about an unnamed maritime-regulated facility, which Dragos said it could confirm through sources was the same event. How the attacker crossed from IT to OT, and whether the site could have been run by hand, are not described. No cost has ever been disclosed.
Recommendation
Take the path to the control room away Nothing on the business network should route to an HMI, a historian or a polling server. CISA names the missing segmentation as what let the adversary cross.
Remove standing access across the line Every crossing from IT into OT is an identity decision made per user and per session, never a network position a compromised Windows host inherits.
Read one way; add a second way to see Historians and pollers push data out one way. CISA asks operators to find single points of failure for visibility and to build redundant channels.
Sources: CISA AA20-049A, 18 Feb 2020 (revised 23 Oct 2020); USCG MSIB 10-19, 16 Dec 2019; Dragos, Assessment of Ransomware Event at U.S. Pipeline Operator, 19 Feb 2020. Full list with links.
Soft Spots: Ryuk is Dragos's sourced join of two anonymous documents, not a CISA finding. The architecture reading is BlastWave's analysis. CISA quotes were checked against two copies of the alert, not its PDF.
The full record
Every claim numbered to its source. Last updated .
A phishing link on a US gas pipeline's office network let commodity ransomware reach the screens its operators watched, the controllers were never touched, and the crew chose to stop. What is verified, what is only reported, and what is still unknown.
Summary
In an alert published on 18 February 2020, CISA described commodity ransomware at an unnamed US natural gas compression facility. A spearphishing link led into the IT network and then the OT network, where operator screens, historians and polling servers were encrypted. No controller was affected and control was never lost. The operator chose to shut down, and the entire pipeline asset was down for about two days.1
Timeline of the US gas compression incident record
Every date is tied to a source. Press reporting appears only as evidence of what was said.
The US Coast Guard publishes Marine Safety Information Bulletin 10-19, "Cyberattack Impacts MTSA Facility Operations," about Ryuk ransomware at an unnamed facility regulated under the Maritime Transportation Security Act. It does not describe a compression facility.2
CISA publishes Alert AA20-049A, "Ransomware Impacting Pipeline Operations." It names no victim, no actor, no ransomware family and no date for the attack, and does not mention the Coast Guard bulletin.1
Dragos publishes "Assessment of Ransomware Event at U.S. Pipeline Operator," saying it can confirm through sources that the CISA and Coast Guard events are the same.3
CISA revises AA20-049A. What changed is not itemized in the versions we read.1
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Dragos says it can "confirm through sources" that this is the Ryuk event in a Coast Guard bulletin about an unnamed maritime-regulated facility2,3
Researcher finding
Which OT systems were affected?
Windows-based HMIs, data historians and polling servers1
Verified
Were the controllers affected?
No PLC impacted, and control of operations was never lost1
Verified
Who stopped the pipeline?
The operator, by a deliberate and controlled shutdown over a four hour transition1
Verified
How long was it down?
The entire pipeline asset, approximately two days1
Verified
Who was the attacker?
No document about this incident names an actor, a group or a country1,2,3
Undisclosed
What did it cost?
No figure published. CISA lists "Loss of Productivity and Revenue" with no amount1
Undisclosed
Did the attackers take control of the gas pipeline?
No. CISA says the controllers were never touched and the operator never lost control. The ransomware reached Windows-based machines on the OT network, the human machine interfaces, data historians and polling servers, and caused what CISA calls "a partial Loss of View."1 It was "limited to Windows-based systems."1
"The attack did not impact any programmable logic controllers (PLCs) and at no point did the victim lose control of operations."
The word "partial" matters. A separate and geographically distinct central control office could still see the system, but it was "not instrumented for control."1 The accurate summary is that the operators lost part of their view. They did not lose control.
Why was the pipeline shut down for two days?
The operator chose to stop it; the ransomware did not. CISA describes a "deliberate and controlled shutdown": a four hour transition from operational to shutdown mode, combined with increased physical security.1 The victim's emergency response plan focused on threats to physical safety and called for a full emergency declaration and immediate shutdown; the victim judged the incident less severe than the plan anticipated and ran limited emergency response measures instead.1
All OT assets directly affected were "limited to a single geographic facility," but geographically distinct compression facilities also had to halt because of pipeline transmission dependencies. The "entire pipeline asset" was down for approximately two days, after which normal operations resumed. The victim recovered with replacement equipment and last known good configurations.1 Dragos adds that the operator chose the controlled shutdown instead of relying on purely manual control.3 Whether manual operation was possible at the site is not stated by anyone.
CISA records that the plan "did not specifically consider cyberattacks," and that emergency response exercises "failed to provide employees with decision-making experience in dealing with cyberattacks." The victim gave its reasons plainly: "gaps in cybersecurity knowledge and the wide range of possible scenarios."1 That candor is what makes the alert useful.
How did the ransomware get from the office network to the control network?
Through a spearphishing link into the IT network, then a pivot to the OT network; how the boundary was crossed is not described. CISA says the attacker deployed commodity ransomware on both networks, and names the reason it could cross: "The victim failed to implement robust segmentation between the IT and OT networks."1 CISA lists robust segmentation between IT and OT first among its technical mitigations.1
Which systems bridged the two networks, and what path the attacker took across, are not in the alert. The Coast Guard bulletin, about its own unnamed facility, says only that the ransomware "may have entered" via "an email phishing campaign."2
Was the gas compression facility hit by Ryuk ransomware?
CISA never named a ransomware family; the Ryuk name rests on a vendor's sourced link between two anonymous government documents. The chain, by date:
16 December 2019: the Coast Guard publishes a bulletin about Ryuk at an unnamed Maritime Transportation Security Act facility, saying it shut down "the primary operations of the facility for over 30 hours." The bulletin describes industrial control systems "that monitor and control cargo transfer" and never mentions compression.2
18 February 2020: CISA publishes its alert. It names no family and does not mention the Coast Guard.1
19 February 2020: Dragos writes that it can confirm through sources that the two events are the same.3
"Dragos can confirm through sources that the two events are the same, and multiple observations demonstrate strong overlap and similarity."
Dragos may well be right, and its assessment is among the most useful things written about the case: it called the activity "well-known ransomware behavior" and "not an ICS-specific or ICS targeted event."3 But its sources are not named. Ryuk is a join, not a finding, and Hackopedia uses the name only with that chain attached.
The two documents also describe different scopes: the Coast Guard's "over 30 hours" for the primary operations of its facility, and CISA's approximately two days for the entire pipeline asset. Both may be true. The Coast Guard's further details, including the entire corporate IT network and camera and physical access control systems, do not appear in CISA's alert and are not facts about the compression facility.1,2
Which company was it, and who was behind the attack?
Neither has been publicly named. CISA says "a natural gas compression facility" and names no company, pipeline, state or attack date.1 No government, company or court document we could find has named the operator, as of late September 2026. No document about this incident names an actor, a group or a country.1,2,3
Where the record declines a name, Hackopedia declines it too, as in the Triton entry. That silence also protects the source that made the alert possible: an operator willing to tell the government its plan was thin.
What is still not known about US Gas Compression
Which company operated the facility, and which pipeline and state it was in. No government, company or court document we could find names them, as of late September 2026.
The date of the attack. CISA gives none; if Dragos's join to the Coast Guard bulletin holds, it predates 16 December 2019.1,2,3
The ransomware family, on CISA's account. Ryuk rests on Dragos's sourced join.1,3
Who carried out the attack. No actor, group or country is named.
How the attacker crossed from IT to OT, and which systems bridged the two networks.1
Whether the site could have been run by hand.
The cost, and any restart timeline beyond CISA's approximately two days.1
What changed in CISA's 23 October 2020 revision of the alert; the revision history lists the date only.1
Claims about US Gas Compression the record does not support
Widely repeated claim
What the record says
"Russian Wizard Spider's Ryuk Malware" was the attacker.
No document about this incident names Wizard Spider or Russia. CISA names no family and no actor; Ryuk rests on Dragos's sourced join.1,2,3,4
"Estimated $8-12M" financial impact.
No cost has been disclosed. The figure appears in none of CISA, the Coast Guard or Dragos, and we could not trace a source for it.1,2,3,4
"Victim: US Gas."
Not a company name. The operator has never been publicly named; CISA says only "a natural gas compression facility."1,4
"It was Ryuk." (stated as fact)
CISA never named a family. The Coast Guard named Ryuk for a maritime-regulated facility it never describes as a compression station; Dragos joined the two "through sources."1,2,3
Including our own. Our Hackopedia Volume 1 page for this incident gave the attacker as "Russian Wizard Spider's Ryuk Malware," gave an "estimated $8-12M" financial impact, and carried a "Victim: US Gas" line that reads like a company name.4 None is supported by any document about the incident, and all three are withdrawn here. We correct our own record first; it is what earns the right to correct anyone else's.
BlastWave analysis: losing sight is not losing control
Analysis, not a disclosed fact
This entry is about the difference between losing control and losing sight. Ransomware crossed into the OT network and reached the screens, historians and polling servers there, yet no command reached a controller.1 That is further than the entries where only the business network was hit, and short of loss of control. The two day shutdown was the operator's decision, and in our judgment, resting on CISA's own account, a good one: the crew ran a four hour controlled transition instead of the immediate shutdown its plan prescribed.
Two ordinary conditions made a phishing email into a two day stop: a path from an inbox to Windows machines on the control side, and no practiced way to run without those screens. Neither is a detection failure. In BlastWave's analysis, not a disclosed fact, removing the first keeps the ransomware in the office, and building the second turns a dark screen into a degraded day.
Podcast: “The Chairlift Hut” (8:59). Joe Baxter and Cam Cullen on why losing sight is not losing control, and why the crew was right to stop.
Video: US Gas Compression Short (60 to 90 seconds).
Frequently asked questions
What happened at the US natural gas compression facility in the 2020 CISA alert?
In Alert AA20-049A, published on 18 February 2020, CISA described a cyberattack on a US natural gas compression facility. A spearphishing link gave access to the IT network, the attacker pivoted to the OT network, and commodity ransomware encrypted Windows machines on both, including operator screens, data historians and polling servers. No controller was affected and control was never lost. The operator chose a controlled shutdown, and the entire pipeline asset was down for approximately two days.
Did hackers take control of the gas pipeline?
No. CISA's February 2020 alert says the attack did not impact any programmable logic controllers and that at no point did the victim lose control of operations. The ransomware was limited to Windows-based systems and caused what CISA calls a partial loss of view for operators. A separate central control office could still see the system but was not instrumented to control it.
Was the gas compression facility attack Ryuk ransomware?
CISA's alert says only commodity ransomware and names no family. A US Coast Guard bulletin of 16 December 2019 named Ryuk at an unnamed facility regulated under the Maritime Transportation Security Act, and never described a compression station. On 19 February 2020 Dragos wrote that it could confirm through sources that the two events were the same. Ryuk therefore rests on that vendor's sourced join, not on a government finding.
Which company was the victim of the CISA pipeline ransomware alert?
The company has not been publicly named. CISA's February 2020 alert refers only to a natural gas compression facility and gives no company, pipeline, state or attack date. As of late September 2026, no government, company or court document we could find has named the operator, and no document about the incident names an attacker, a group or a country.
Why was the pipeline shut down for two days?
The operator chose to shut it down. According to CISA, the operator ran a deliberate and controlled shutdown, a four hour transition from operational to shutdown mode with increased physical security. Other compression facilities had to halt because of pipeline transmission dependencies, and the entire pipeline asset was down for approximately two days before normal operations resumed. CISA says the operator's emergency plan did not specifically consider cyberattacks.
How did the ransomware reach the pipeline's control network?
CISA says the attacker used a spearphishing link to get into the IT network and then pivoted to the OT network. CISA's finding is that the victim failed to implement robust segmentation between the IT and OT networks, which let the attacker cross the boundary. The alert does not describe how the crossing was made or which systems bridged the two networks.
How much did the gas compression facility ransomware attack cost?
No cost has been disclosed. CISA's February 2020 alert records a loss of productivity and revenue as a category but gives no figure, and neither the Coast Guard nor Dragos published one. An estimate of 8 to 12 million dollars once shown on BlastWave's own Volume 1 Hackopedia page could not be traced to any source and has been withdrawn.
The primary source is CISA's alert. The Coast Guard bulletin and Dragos's assessment are cited for what each published, and our own Volume 1 page only as evidence of what it claimed.
FederalCISA, Alert AA20-049A, "Ransomware Impacting Pipeline Operations," released 18 February 2020, revised 23 October 2020. cisa.gov · US-CERT list copy
FederalUS Coast Guard, Marine Safety Information Bulletin 10-19, "Cyberattack Impacts MTSA Facility Operations," 16 December 2019. PDF
ResearcherDragos, "Assessment of Ransomware Event at U.S. Pipeline Operator," 19 February 2020. dragos.com
CompanyBlastWave, Hackopedia Volume 1, "US Gas Compression Facility Ransomware (2020)," page read 24 September 2026. Cited only as evidence of what Volume 1 claimed. hackopedia.blastwave.com
Cite this page
BlastWave. “US Natural Gas Compression Facility Ransomware Incident (Disclosed 2020): What Is Verified.” Hackopedia, Volume 2, FILE 007. Last verified 28 September 2026. https://hackopedia.blastwave.com/oil-and-gas/us-gas-compression-2020/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 007 in Hackopedia Volume 2, in the Oil and Gas edition.
28 Sep 2026
Final consistency check against related entries. Consequence statement made precise: the ransomware reached operator screens, historians and polling servers on the control network, no controller was affected, control was never lost, and the shutdown was the operator's decision. Facts unchanged.
26 Sep 2026
Full validation: every claim re-checked against the alert, and every statement about related incidents checked against those entries.
25 Sep 2026
Every CISA, Coast Guard and Dragos quotation re-checked sentence by sentence against the published texts. The reason other stations stopped narrowed to CISA's "pipeline transmission dependencies."
24 Sep 2026
Volume 2 entry built from primary sources. Corrected three Volume 1 errors: an unsourced attacker group and country, an unsourced cost estimate, and a victim line that read like a company name.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
