Cyber Sleuths Blunted Pipeline Hack, Choked Data Flow to Russia

A small group of private-sector companies, with help from several U.S. agencies, disrupted ongoing cyber-attacks against Colonial Pipeline Co. and more than two dozen other victims, according to people with knowledge of the matter.

Colonial was able to recover some stolen data because of the intervention, which stopped the flow of stolen data headed to Russia -- believed to be the ultimate destination, according to three people involved with or briefed about the investigation into the breach.

The takedown, which occurred on May 8, was enacted by companies that included operators of U.S.-based servers used by the hackers, the people ...