incident · 1620345600000

Colonial Pipeline Ransomware Attack

A ransomware attack by the DarkSide group forced Colonial Pipeline to proactively shut down its operations, leading to significant fuel shortages across the Eastern United States.

What happened

On May 7, 2021, Colonial Pipeline, which supplies roughly 45% of the fuel for the U.S. East Coast, suffered a ransomware attack. To contain the threat and ensure the safety of its operational technology (OT) networks, the company proactively halted all pipeline operations. This disruption caused widespread panic buying and fuel shortages across several states. Colonial Pipeline paid a ransom of approximately $4.4 million (75 Bitcoin) to the attackers to restore operations, which resumed on May 12, 2021.

Technical mechanism

The attackers gained entry to Colonial Pipeline's IT network through an exposed virtual private network (VPN) account that did not use multi-factor authentication (MFA). After gaining access, they deployed DarkSide ransomware to encrypt data and systems.

Why it matters

The incident highlighted the severe vulnerability of critical national infrastructure to cyberattacks and the cascading physical and economic impacts of ransomware.

Impact

The shutdown caused major fuel shortages, price spikes, and panic buying across the Eastern Seaboard. The company paid a $4.4 million ransom, though the DOJ later recovered a significant portion of it. The incident prompted emergency declarations from the federal government.

Response

The U.S. government launched a coordinated response involving CISA, the FBI, and the Department of Energy. The DOJ subsequently recovered approximately $2.3 million of the paid ransom. The incident spurred the TSA to issue new mandatory cybersecurity directives for critical pipeline owners and operators.

Defensive lessons

  • Multi-factor authentication (MFA) is a critical baseline defense for all remote access and VPNs.
  • Robust network segmentation between IT and OT environments is essential to prevent IT compromises from forcing operational shutdowns.
  • Incident response plans must account for the physical and economic impacts of critical infrastructure disruption.

Evidence register

  1. Cybersecurity and Infrastructure Security Agency (CISA) — The Attack on Colonial Pipeline: What We've Learned & What We've Done Over the Past Two Years (verified)