MyRecon OSINT

← Case Files · The Breach Files

2021 · Energy

Colonial Pipeline, 2021: one leaked password, and the fuel stopped

Case file · 4 min read · Published 14 September 2026

People affected
Operational shutdown; a limited number of personal records also taken
When it happened
6–7 May 2021
Made public
8 May 2021
How they got in
A legacy VPN account with no multi-factor authentication, using a password found in a breach dump
Attributed to
The DarkSide ransomware group
What it cost
A $4.4 million ransom, of which about $2.3 million was later recovered by the FBI

What was exposed: Business systems and billing data · Personal data of a small number of individuals

On 7 May 2021, a ransomware group encrypted the business systems of a company most Americans had never heard of. Within days, petrol stations across the south-eastern United States had bags over their pumps, airlines were rerouting to refuel, and the president was giving press conferences about fuel supply. The way in was a dormant VPN account with a reused password and no second factor.

What happened

Colonial Pipeline moves refined fuel — petrol, diesel, jet fuel — from the Gulf Coast to the eastern United States, supplying a large share of the region's consumption. It is private infrastructure performing a public function, which is a description that fits a great deal of what modern countries run on.

The DarkSide ransomware group obtained credentials for a virtual private network account that was no longer in active use. The account had no multi-factor authentication. The password, according to the subsequent investigation, appeared in a set of leaked credentials — the signature of password reuse, where a password harvested from an unrelated breach is tried against corporate remote access.

They entered, moved through the IT environment, exfiltrated data and deployed ransomware against business systems including billing. Colonial discovered the attack on the morning of 7 May and shut down pipeline operations.

The shutdown was not the hack. This distinction gets lost constantly. Nobody took control of valves or pumps. The pipeline stopped because the company could not bill for deliveries and could not immediately prove the intrusion had not reached the operational side of the business. In an environment where IT and operational technology are connected in ways nobody has fully mapped, "we are not sure how far this goes" resolves to "stop".

The ransom, and the recovery of it

Colonial paid roughly $4.4 million in bitcoin within hours of the attack. The chief executive later told Congress it was the hardest decision of his career and that he authorised it because he did not know how long restoration would take.

The decryptor DarkSide supplied was so slow that the company relied largely on its own backups regardless — a common outcome, and a reason paying is a worse bet than it looks in the moment.

What happened next was more interesting. In June 2021 the Department of Justice announced it had seized about 63.7 bitcoin, then worth roughly $2.3 million, from the ransom wallet. It demonstrated publicly that cryptocurrency payments are traceable and, with the right access, recoverable — and it marked the start of a US policy of pursuing the money rather than only the intruders.

The timeline

  1. 29 April 2021 — The dormant VPN account is used to gain access.
  2. 6 May 2021 — Roughly 100GB of data is exfiltrated.
  3. 7 May 2021 — Ransomware is deployed; Colonial halts pipeline operations; the ransom is paid the same day.
  4. 9 May 2021 — A regional emergency declaration relaxes fuel transport rules; panic buying begins.
  5. 12 May 2021 — Pipeline operations restart; supply normalises over the following days.
  6. 7 June 2021 — The Department of Justice announces the seizure of about $2.3 million of the payment.
  7. Mid-2021 — The TSA issues the first mandatory cybersecurity directives for pipeline operators.

What it changed

Critical infrastructure security became mandatory rather than voluntary. Pipeline cybersecurity in the United States had been governed by guidance. Within weeks, the Transportation Security Administration issued binding directives requiring incident reporting, a cybersecurity coordinator, vulnerability assessment and remediation plans. Industry pushback was substantial and the directives were revised, but the principle — that this is regulated safety, not discretionary IT spending — held.

Ransomware became a national security matter. The attack reframed the problem for governments: a criminal group with no political objective had produced fuel queues in a G7 country. Sanctions, disruption operations against ransomware infrastructure, and diplomatic pressure on jurisdictions harbouring these groups all accelerated from this point.

Dormant accounts got audited. The specific technical lesson is embarrassingly small next to the consequences. Disable accounts when people leave. Require multi-factor authentication on every remote access path, including the legacy one nobody uses. Check corporate credentials against breach corpora, because your employees reuse passwords and the evidence of it is published.

The uncomfortable arithmetic

Every element of this attack was ordinary. Commodity ransomware bought as a service. A credential probably harvested from a breach dump. An account someone forgot to disable. No zero-day, no nation-state, no novel technique.

That is the part worth carrying forward. The gap between "ordinary attack" and "national fuel emergency" was not attacker sophistication; it was a set of routine controls that had not been applied to a legacy corner of one company's network. Most infrastructure operators, examined honestly, have that corner.

What to take from it

  1. If you administer anything: inventory every remote access path and put MFA on all of them. Including the ones you think are unused — those are the ones that get used.
  2. Check corporate email domains against breach corpora. Reused employee passwords are visible in public data long before they are used against you.
  3. Decide the payment question before you need to answer it, in writing, with legal and executive input. Colonial's chief executive made a multi-million dollar decision in hours with no prepared position.
  4. As an individual, the lesson is the same as always: the password you reused at work came from somewhere — how to stop that being true of you.

Checked against every breach on record, against public breach data only. Your address is not sent to us as a form and is not stored — it is handed straight to the lookup tool in your own browser. See the privacy policy.

Questions people ask

Did hackers take control of the pipeline?

No. The ransomware hit the business IT network, including billing systems. Colonial shut the pipeline itself as a precaution, because it could not reliably bill for fuel it delivered and could not be certain the intrusion had not reached operational systems. The physical shutdown was a business and safety decision, not a hijacking.

How did the attackers get in?

Through a virtual private network account that was no longer in active use and was not protected by multi-factor authentication. The password appeared in a batch of leaked credentials, suggesting it had been reused elsewhere and harvested from an unrelated breach. One dormant account, one reused password, no second factor.

Did Colonial pay?

Yes — around $4.4 million in bitcoin, within hours. The decryption tool provided in return worked so slowly that the company largely restored from its own backups anyway. In June 2021 the US Department of Justice announced it had seized about $2.3 million of the payment.

Why did petrol stations run dry if the pipeline restarted in six days?

Panic buying. The shortages across the south-eastern United States were driven mainly by consumers filling every container they could find, not by the volume of fuel lost. It is a useful reminder that the second-order effects of an incident can be larger than the incident.

Sources

Read next

Case files are written from the public record: regulatory findings, court filings, company disclosures and contemporaneous reporting, cited above. Figures are the ones the organisation or its regulator finally settled on, which is often not the number first reported — where that differs, the page says so. Disputed accounts are marked as disputed rather than resolved in either direction.

← All case files Breach archive →