Quick answer: In May 2021, the DarkSide ransomware group got into Colonial Pipeline’s network through a legacy VPN account protected only by a password, without multifactor authentication. Colonial shut down the largest fuel pipeline on the US East Coast as a precaution, causing fuel shortages and panic buying. CEO Joseph Blount paid a ransom of about $4.4 million, and the US Department of Justice later recovered about $2.3 million of it.
| Key facts | |
|---|---|
| Date | May 2021 (attack discovered 7 May 2021) |
| Organization | Colonial Pipeline (US fuel pipeline operator) |
| Type of attack | Ransomware |
| Attacker | DarkSide ransomware group |
| How they got in | A legacy VPN account with a password but no MFA, according to CEO Joseph Blount |
| Impact | Pipeline shut down for several days; fuel shortages on the US East Coast; about $4.4 million ransom paid |
Timeline
- 7 May 2021: Colonial discovers the ransomware attack and shuts down the pipeline.
- Following days: Fuel shortages and panic buying spread across the US East Coast.
- 12 May 2021: Colonial begins restarting the pipeline.
- 7 June 2021: The Department of Justice announces it has recovered about $2.3 million of the ransom.
- 8 June 2021: CEO Joseph Blount testifies to the US Senate.
What happened
Colonial Pipeline carries gasoline, diesel and jet fuel from Texas to the US East Coast. When the DarkSide ransomware group hit its business IT systems in May 2021, Colonial shut down the pipeline itself as a precaution, because it could not be sure the attack would not spread or that it could bill customers correctly.
The shutdown caused fuel shortages and long queues at petrol stations across several states.
One password, no MFA
Testifying before the US Senate on 8 June 2021, CEO Joseph Blount said the attackers got in through a legacy VPN that used only single-factor authentication. He stressed the password was complex, not “a Colonial123-type password”, but it was not protected by multifactor authentication.
Blount said the decision to pay the ransom, about $4.4 million in Bitcoin, was one of the hardest he had ever made. The Department of Justice later traced and recovered about $2.3 million.
Lessons for your organization
- Require MFA on every VPN and remote access account, and disable unused legacy accounts.
- Separate business IT from operational systems so an IT attack does not force a full shutdown.
- Plan how critical services can keep running safely during an IT outage.
- Report attacks to law enforcement quickly: it made recovering part of the ransom possible.
- Check password managers and breach monitoring for exposed employee credentials.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. Learn more about ransomware. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Related reading
Change Healthcare Ransomware Attack: The Largest US Healthcare Breach
Jaguar Land Rover Cyber Attack: How Car Production Stopped
Frequently asked questions
How did hackers get into Colonial Pipeline?
Through a legacy VPN account protected by a password but not by multifactor authentication, according to CEO Joseph Blount’s Senate testimony.
How much ransom did Colonial Pipeline pay?
About $4.4 million in Bitcoin. The US Department of Justice later recovered about $2.3 million.
Who was behind the Colonial Pipeline attack?
The DarkSide ransomware group.
