Among the three authors of the news agency's report was Michael Riley, one of the authors of the infamous "grain of rice" yarn that claimed an additional chip had been planted on the motherboards of servers made by US firm Super Micro Computer in order to effect a supply chain attack.
Riley, along with William Turton and Jennifer Jacobs, claimed that the payment of nearly US$5 million contradicted earlier reports — made, among others, by Reuters — that Colonial would not pay a ransom in order to obtain a decryptor.
According to the Bloomberg version, the ransom was paid, as usual in cryptocurrency, "within hours after the attack" which would place the transaction as having taken place last week.
I don't know what you're talking about. pic.twitter.com/KagVxSrkLB
— Will Dormann (@wdormann) May 13, 2021
Only one detail of the Bloomberg story about the Colonial ransom can be verified: the claim that the company had to use its own back-ups for restoration, rather than depend on the supplied decryptor, as the latter was much slower.
This is backed up by Emsisoft, a New Zealand-headquartered ransomware specialist, which wrote in a blog post earlier this year: "According to our performance tests, DarkSide’s decryption tool decrypts files at an average of 231.40MB per second.
"In comparison, Emsisoft’s universal decryptor tool decrypts DarkSide-encrypted files at an average of 608.70MB per second. For context, decrypting 1 TB of encrypted files would take about 72 minutes with DarkSide’s decryptor and approximately 27 minutes with Emsisoft's decryption tool."
Going by its own comments, the gang behind DarkSide appeared to be somewhat taken aback when they realised the company that their affiliates had attecked.