The Colonial Pipeline ransomware attack (2021)

What happened

On May 7, 2021, Colonial Pipeline Company discovered a ransomware attack on its information technology systems. Colonial operates one of the largest refined-fuel pipeline systems in the United States, running about 5,500 miles from the Gulf Coast to the New York area and carrying gasoline, diesel and jet fuel for much of the East Coast.

The ransomware hit the company's business and billing systems, not the operational technology that physically controls the pipeline. Even so, Colonial shut down pipeline operations as a precaution, partly because it was unsure how far the attack had spread and partly because it could not reliably bill and track fuel deliveries. The pipeline restarted on May 12, and normal operations resumed over the following days.

How it worked

Colonial's chief executive later told the US Senate that the attackers got in using the password of a legacy VPN account that was no longer in active use but had not been disabled. The account did not require multi-factor authentication. The password was believed to have been exposed in an earlier, unrelated data leak.

The attack was attributed by the FBI to DarkSide, a criminal ransomware-as-a-service operation. In this model, the developers rent their ransomware to "affiliates" who break into victims and share the ransom. The attackers also stole a large amount of data before encrypting systems, a "double extortion" tactic common in modern ransomware. For the general mechanics, see ransomware explained.

Impact

• Fuel supply. The shutdown, combined with panic buying, caused gas stations across parts of the Southeast to run out of fuel for several days.
• Ransom. Colonial paid a ransom of about 75 bitcoin, worth roughly $4.4 million at the time, to get a decryption tool. Its chief executive said the tool was slow, and the company also relied on its own backups to recover.
• Partial recovery of funds. In June 2021, the US Department of Justice announced it had recovered 63.7 bitcoin of the payment, then worth about $2.3 million, after tracing it on the blockchain.
• Policy changes. US regulators issued new cybersecurity requirements for pipeline operators, including incident reporting and resilience planning.

What defenders learned

• Disable unused accounts. A forgotten account with a reused password was the way in. Regular access reviews and prompt offboarding close those doors. See access control and offboarding.
• MFA on all remote access. A VPN protected only by a password is an open invitation.
• IT problems can stop physical operations. Even when control systems are untouched, the business systems around them (billing, scheduling, logistics) may be essential to running safely.
• Plan and practice recovery. Backups and a rehearsed plan reduce both downtime and pressure to pay.
• Blockchain is traceable. Ransom payments can sometimes be followed and seized, which changes the economics for criminals.

What it means for you

For individuals, the lesson is about old accounts and reused passwords. Delete accounts you no longer use, make every password unique with a password manager, and turn on two-factor authentication everywhere it is offered. For businesses, the equivalent is an access review, MFA on remote access and a tested backup and recovery plan.