Traders provisionally booked at least six tankers to ship gasoline from Europe to the U.S. following a cyber attack that shut the U.S.'s top fuel pipeline network, Refinitiv Eikon data showed on Monday.
The attack forced the Colonial Pipeline to shut down its entire system on Friday, stoking expectations of gasoline shortages along the East Coast.
According to the company's statement, some smaller lines restarted Sunday, but the main ones remain offline.
The privately owned company on Monday said it was working on restarting in phases with "the goal of substantially restoring operational service by the end of the week."
Two European gasoline traders said the market was taking a cautious approach to see how long the shutdown would last.
"I haven't seen any big pick up but it would be normal for people to preemptively take vessels on subs," a traders told Reuters. Subs is a term used in the oil market to describe a provisional booking for a tanker.
A second trader said that rallying freight rates amid a flurry of bookings into the New York Harbor may have weighed on arbitrage economics from Europe.
European Ebob barge refining margins reached $10.38 a barrel on Monday, up from $9.35 on Friday, according to Reuters calculations.
"Should the ... network remain down for more than a few days, the nation's East Coast and southeastern markets will start to see supply hiccups and related price spikes, while Gulf Coast refining centers will scramble to place cargoes alternatively," oil analytics firm Vortexa said in a note.
The Federal Bureau of Investigation (FBI) has accused the group that calls itself DarkSide of a digital extortion attempt that prompted Colonial Pipeline to shut down its network.
On Monday, DarkSide posted a terse news release on its website, which did not directly mention Colonial Pipeline but, under the heading "About the latest news," it noted that "our goal is to make money, and not creating problems for society."
DarkSide's statement went on to say that its hackers would launch checks on fellow cyber criminals "to avoid consequences in the future." It added the group was "apolitical" and that observers "do not need to tie us" with any particular government.
The statement, which had several spelling and grammatical errors, appeared to be geared toward lowering the political temperature around one of the most disruptive digital extortion schemes ever reported.
The FBI, Department of Energy and White House have all been involved in a rapid response to the hack, and a server used by the gang was shut down over the weekend.