WASHINGTON, May 12 (Reuters) – Colonial Pipeline does not plan to pay the ransom demanded by hackers who have encrypted its data, according to sources familiar with the company’s response on Wednesday.

The hack prompted a pipeline shutdown that is now in its sixth day and has led to panic buying and gasoline shortages in the southeastern United States. read more

Colonial said it began reopening its line late Wednesdy afternoon, a process that may last days. It declined to comment on the ransom issue.

Colonial is working closely with law enforcement, the Department of Energy and U.S. cybersecurity firm FireEye to mitigate the damage and restore operations.

The Colonial and government answer to the breach is being closely watched after one of the most direct hacking attacks on American critical infrastructure after years of warnings.

President Joe Biden said this week that Russia should bear some responsibility for the disruption, since the hacking came from inside its borders.

Ransomware attacks have increased in number and amount of demands, with hackers encrypting data and seeking payment in cryptocurrency to unlock it. They increasingly release stolen data as well, or threaten to unless they are paid more.

Investigators in the Colonial case say the attack software was distributed by a gang called DarkSide, which includes Russian speakers and avoids hacking targets in the former Soviet Union.

DarkSide previously said that it did not intend to medde in geopolitics and would be more careful about its affiliates in the future.

On Wednesday, the group said on its website that it was releasing data from three more victims, including a technology company in Chicago.

Officials so far have found no significant connection to the Russian government, instead concluding that the pipeline company delivering 45% of the U.S. East Coast’s oil was crippled by ransomware attack.

DarkSide lets “affiliates” hack into targets elsewhere, then handles the ransom negotiation and data release.

Two people involved with the Colonial investigation said the affiliate in this case was a Russian criminal with no special government ties.

(This story refiles to fix typographical error in paragraph 10)

Reporting by Christopher Bing and Joe Menn; Editing by Leslie Adler

Our Standards: The Thomson Reuters Trust Principles.