Colonial Pipeline, 2021: one leaked password, and the fuel stopped

On 7 May 2021, a ransomware group encrypted the business systems of a company most Americans had never heard of. Within days, petrol stations across the south-eastern United States had bags over their pumps, airlines were rerouting to refuel, and the president was giving press conferences about fuel supply. The way in was a dormant VPN account with a reused password and no second factor.

What happened

Colonial Pipeline moves refined fuel, petrol, diesel, jet fuel, from the Gulf Coast to the eastern United States, supplying a large share of the region's consumption. It is private infrastructure performing a public function, which is a description that fits a great deal of what modern countries run on.

The DarkSide ransomware group obtained credentials for a virtual private network account that was no longer in active use. The account had no multi-factor authentication. The password, according to the subsequent investigation, appeared in a set of leaked credentials, the signature of password reuse, where a password harvested from an unrelated breach is tried against corporate remote access.

They entered, moved through the IT environment, exfiltrated data and deployed ransomware against business systems including billing. Colonial discovered the attack on the morning of 7 May and shut down pipeline operations.

The ransom, and the recovery of it

Colonial paid roughly $4.4 million in bitcoin within hours of the attack. The chief executive later told Congress it was the hardest decision of his career and that he authorised it because he did not know how long restoration would take.

The decryptor DarkSide supplied was so slow that the company relied largely on its own backups regardless, a common outcome, and a reason paying is a worse bet than it looks in the moment.

What happened next was more interesting. In June 2021 the Department of Justice announced it had seized about 63.7 bitcoin, then worth roughly $2.3 million, from the ransom wallet. It demonstrated publicly that cryptocurrency payments are traceable and, with the right access, recoverable, and it marked the start of a US policy of pursuing the money rather than only the intruders.

The timeline

1. 29 April 2021: The dormant VPN account is used to gain access.
2. 6 May 2021: Roughly 100GB of data is exfiltrated.
3. 7 May 2021: Ransomware is deployed; Colonial halts pipeline operations; the ransom is paid the same day.
4. 9 May 2021: A regional emergency declaration relaxes fuel transport rules; panic buying begins.
5. 12 May 2021: Pipeline operations restart; supply normalises over the following days.
6. 7 June 2021: The Department of Justice announces the seizure of about $2.3 million of the payment.
7. Mid-2021: The TSA issues the first mandatory cybersecurity directives for pipeline operators.

What it changed

Critical infrastructure security became mandatory rather than voluntary. Pipeline cybersecurity in the United States had been governed by guidance. Within weeks, the Transportation Security Administration issued binding directives requiring incident reporting, a cybersecurity coordinator, vulnerability assessment and remediation plans. Industry pushback was substantial and the directives were revised, but the principle, that this is regulated safety, not discretionary IT spending, held.

Ransomware became a national security matter. The attack reframed the problem for governments: a criminal group with no political objective had produced fuel queues in a G7 country. Sanctions, disruption operations against ransomware infrastructure, and diplomatic pressure on jurisdictions harbouring these groups all accelerated from this point.

Dormant accounts got audited. The specific technical lesson is embarrassingly small next to the consequences. Disable accounts when people leave. Require multi-factor authentication on every remote access path, including the legacy one nobody uses. Check corporate credentials against breach corpora, because your employees reuse passwords and the evidence of it is published.

The uncomfortable arithmetic

Every element of this attack was ordinary. Commodity ransomware bought as a service. A credential probably harvested from a breach dump. An account someone forgot to disable. No zero-day, no nation-state, no novel technique.

That is the part worth carrying forward. The gap between "ordinary attack" and "national fuel emergency" was not attacker sophistication; it was a set of routine controls that had not been applied to a legacy corner of one company's network. Most infrastructure operators, examined honestly, have that corner.

What to take from it