> The article says the ransomware message appeared on a computer in the control room. That seems strange That computer was probably their "office" computer, wh

> The article says the ransomware message appeared on a computer in the control room. That seems strange That computer was probably their "office" computer, which they would use for things like email. From what I understood from the article ("[...] an employee in Colonial’s control room saw a ransom note demanding cryptocurrency appear on a computer just before 5 a.m. The employee notified an operations supervisor who immediately began to start the process of shutting down the pipeline, [...]. By 6:10 a.m., the entire pipeline had been shut down"), the supervisor made the sensible decision of immediately starting an orderly shutdown of the pipeline, before the thing propagated to their control computers; as can be seen by the timing, doing an orderly shutdown takes a while.