The hack prompted a pipeline shutdown that is now in its sixth day and has led to panic buying and gasoline shortages in the southeastern United States.
Colonial said it began reopening its line late Wednesdy afternoon, a process that may last days. It declined to comment on the ransom issue.
Colonial is working closely with law enforcement, the Department of Energy and U.S. cybersecurity firm FireEye to mitigate the damage and restore operations.
The Colonial and government answer to the breach is being closely watched after one of the most direct hacking attacks on American critical infrastructure after years of warnings.