Colonial Pipeline 2021: the password that shut off America's fuel

On the morning of Friday 7 May 2021, Colonial Pipeline's operators got the news no IT team ever wants to deliver: ransomware on the network. Within hours, the company took a drastic decision — manually shutting down the largest fuel pipeline in the United States to contain the spread. The result was queues at petrol stations, panic buying, cancelled flights and a national emergency declaration. The cause: a single VPN password with no multi-factor authentication, found in a database stolen months earlier.

Who Colonial Pipeline is

Colonial Pipeline operates 5,500 miles (8,850 km) of pipeline carrying petrol, diesel and jet fuel from Texas up to New York. The system supplies 45% of the fuel consumed on the US East Coast — an artery so critical that any interruption is felt at petrol stations, hospitals and airports within hours.

Critical infrastructure doesn't need to be wired into military systems to be a valuable target. It only needs a real, tangible impact on the population to attract ransomware groups willing to bet the victim will pay.

How DarkSide got in: an old password with no MFA

The subsequent investigation, led by the FBI and the security firm Mandiant, revealed that the DarkSide group accessed Colonial Pipeline's network through a legacy VPN account — created for remote access, but no longer in active use by the company. The account's password was technically complex. The problem: it had been exposed in an earlier data breach and was sitting in some compiled database on the dark web.

The entry vector wasn't sophisticated. It was basic OSINT reconnaissance: search for leaked credentials tied to the company's domain. They found one. They walked in.

The detail that turned a compromised login into a catastrophe: the account had no multi-factor authentication enabled. Without that second factor, the password was the only barrier — and it was already in the wrong hands before the attack began.

If you use a VPN for remote access, it's worth understanding what a VPN really protects and where it falls short — the Colonial Pipeline case is one of the clearest examples that the tool is no substitute for the authentication layer.

DarkSide and the Ransomware-as-a-Service model

DarkSide operated on the Ransomware-as-a-Service (RaaS) model: one group develops and maintains the ransomware and its supporting infrastructure; another, known as an "affiliate", carries out the attacks and hands over a commission on each ransom. It is essentially a franchise for organised digital crime, complete with an operations manual, technical support and profit sharing.

The group presented itself as "professional" — it even had an FAQ page for victims, promised not to attack hospitals or NGOs, and claimed to select targets based on their ability to pay. None of those promises made the impact on the American public any less real.

DarkSide is believed to have operated out of Eastern Europe, most likely Russia, which makes extradition practically impossible.

The six days that emptied the petrol stations

With the pipeline offline, the effects reached the physical world fast:

• Queues at petrol stations in at least 11 East Coast states
• The average price of petrol hit its highest level in seven years
• Airports in the south-eastern US faced jet fuel shortages
• President Biden signed an emergency declaration freeing up alternative transport
• The government temporarily waived restrictions on shipping fuel by sea to make up the shortfall

Even after operations resumed on 12 May, the shortages lingered for another week — the time the distribution system needed to recover from six days at a standstill.

The ransom payment and what the FBI clawed back

Is it worth paying the ransom in a ransomware attack?

The technical and ethical answer is no — but in practice, the decision depends on the context and the alternatives available. Colonial Pipeline chose to pay: 75 bitcoin, worth US$4.4 million at the time of the transfer. The company's leadership judged it the fastest way to guarantee operations would resume and to minimise the impact on supply.

The decision was widely criticised by security experts, who argue that payments validate the criminal business model and fund future attacks. The FBI formally recommends against paying.

What came next was unusual: on 7 June 2021, the Department of Justice announced the recovery of 63.7 bitcoin (around US$2.3 million). The FBI traced the flow of transactions on the blockchain to a wallet at an exchange with a US presence, obtained a court order and seized the private key before the funds could be moved out of reach.

The case showed that Bitcoin is not as anonymous as criminal groups tend to assume — and that blockchain analysis combined with swift legal action can, under the right circumstances, reverse part of the financial damage.

The lessons Colonial Pipeline left behind

Is one leaked password with no MFA enough for an attack of national impact?

Yes. The Colonial Pipeline case proves exactly that. A credential compromised in an earlier breach, tied to a VPN account with no second authentication factor, was the only entry point needed to cause a six-day fuel supply crisis.

The controls that would have blocked the attack are basic:

• MFA on all remote access — VPN, RDP, SSH. A strong password isn't enough if it can be obtained from another breach.
• Audit and disable legacy accounts — the compromised account was inactive. Unused accounts should be disabled, not just forgotten.
• Monitor for leaked credentials — services like HaveIBeenPwned and corporate solutions (SpyCloud, Enzoic) alert you when your domains and email addresses turn up in compiled databases.
• Segment the network between IT and OT — the ransomware hit the corporate systems; the decision to stop the pipeline was precautionary. Proper segmentation would have isolated the incident faster.

Ransomware doesn't only go after big targets — any organisation without basic defences is in the same position. To structure a response, see how to protect yourself from ransomware and why the 3-2-1 backup rule exists specifically for this scenario.

A pattern that keeps repeating

Colonial Pipeline wasn't the first major incident caused by a simple vector — and it wasn't the last. WannaCry in 2017 spread through exposed SMB ports on unsegmented, unpatched networks. In both cases, the attacker needed no extraordinary sophistication: the door was already open.

The bigger lesson isn't about pipelines or Bitcoin. It's about the basics the defence failed to do. MFA, an inventory of active accounts, credential monitoring and network segmentation are controls that exist precisely to close those doors before someone finds them — with or without a pipeline on the other side.