Colonial Pipeline: one old password, one week without fuel

The story

Colonial Pipeline carries gasoline, diesel and jet fuel from Texas to the US East Coast. On May 7, 2021, it was hit by ransomware from a criminal group called DarkSide. The company shut the whole pipeline down as a precaution.

For about a week, fuel stopped flowing. People panic-bought, and many gas stations in the Southeast ran out. Colonial paid the ransom within hours. The tool the attackers provided to unlock files was so slow that it was of limited help. US authorities later recovered most of the payment.

The company’s chief executive told the US Senate how the attackers had gotten in: through an old account for the company’s VPN, its remote access system. The account was no longer in use but had not been switched off. It had no second sign-in step, and its password had appeared in a leak of stolen passwords.

Why it mattered

For many Americans, it was the first time ransomware showed up somewhere they could see it: at the gas pump. Within weeks, the US government issued new cybersecurity requirements for major pipeline operators, including reporting attacks to federal authorities, and ransomware came to be treated as a matter of national security.

The lesson today

One forgotten account, one reused password and no second step at sign-in were enough to stop fuel to a large part of the country. The fixes are basic and cheap: switch off accounts that are not needed, require multi-factor authentication on remote access, and watch for company passwords that turn up in leaks.