Anybody know who’s behind the hack?
Yes!
A hacker group called Darkside:
https://www.washingtonpost.com/business/2021/05/10/colonial-pipeline-gas-oil-markets/
If Colonial plans to be back in operation by the end of the week, as stated in my linked article, then they either have restored backups or they paid DarkSide's ransom.