Federal officials, executives and cybersecurity experts say they are making slow progress on restarting Colonial Pipeline facilities after Friday’s crippling ransomware attack. The pipeline is expected to be back online by midday Thursday, but affected areas are already seeing rising prices and gas shortages.

Attempts to revive the pipeline began Wednesday around 5 p.m. ET and “went well overnight,” Energy Secretary Jennifer Granholm told reporters.

The company says it expects to resume service to all areas Thursday. “This should mean things will return to normal by the end of the weekend,” said Granholm.

Georgia-based Colonial Pipeline operates the country’s largest refined products pipeline. It normally transports 2.5 million barrels per day, according to its official website.

States across the Southeast are already dealing with soaring prices and widespread outages. Gas prices in Georgia went up 25 cents since the attack, with South Carolina, North Carolina and Virginia seeing prices go up by 19, 17 and 16 cents respectively.

Collectively, the rise was enough to bring the average for the entire nation above $3 per gallon according to AAA.

Affected states were also prone to outages. Tracking service GasBuddy showed a majority of stations in South Carolina, North Carolina and Virginia completely out of fuel.

The situation is exacerbated by long lines of drivers trying to stock up. Public officials urged consumers to refrain from hoarding and panic buying. They also warned of unscrupulous vendors using the emergency to gouge prices.

In an attempt to ameliorate demand, the EPA and Department of Transportation suspended some regulations around fuel transport and production. The Jones Act, which mandates U.S.-flagged ships for transporting goods between U.S. ports, was waived for one company.

It’s not yet publicly known whether Colonial Pipeline paid the ransom demanded by hacker group DarkSide. Bloomberg reported that the company has paid almost $5 million, but sources told the Washington Post that Colonial hadn’t paid anything and didn’t intend to.

Even if the pipeline is restored to functionality, DarkSide’s characteristic “double extortion” scheme threatens to publish company data unless its demands are met.

While ransomware attacks have grown to be associated with Russia, the Biden administration says this attack seems unconnected to the Kremlin.

“So far there is no evidence from our intelligence people that Russia is involved although there is evidence that the actor’s ransomware is in Russia. They have some responsibility to deal with this,” President Biden said Monday.

Stations with fuel in their tanks saw long lines of motorists rushing to fill up amid the Colonial Pipeline shutdown
Stations with fuel in their tanks saw long lines of motorists rushing to fill up amid the Colonial Pipeline shutdown AFP / JIM WATSON