The Colonial Pipeline Attack: One Old VPN Password and a Fuel Crisis

On 7 May 2021, Colonial Pipeline, the operator of a fuel pipeline system running from Texas to the north-eastern United States, shut down its operations after a ransomware attack. Petrol stations ran dry in several states, drivers queued with jerry cans and the US government declared a regional emergency. It was a vivid demonstration of how a cyberattack on a company's office systems can disrupt daily life far beyond it.

What happened

Colonial's pipeline network is around 5,500 miles long and carries gasoline, diesel and jet fuel. The company said it supplied roughly 45 percent of the fuel consumed on the US East Coast. The attack was carried out by a criminal group called DarkSide, which ran what is known as ransomware-as-a-service: it developed the malware and let affiliates use it in return for a share of the ransom.

The ransomware hit Colonial's business systems, not the equipment that physically controls the pipeline. But the company chose to shut the pipeline down, because it was concerned about the attackers reaching operational systems and because without billing systems it could not properly track fuel deliveries. Operations were restarted on 12 May, and it took several more days for supply to return to normal.

How the attackers got in

Colonial's chief executive, Joseph Blount, and the security firm Mandiant, which investigated, later explained that the attackers entered through a virtual private network account. The account was no longer in use, but it had not been disabled, and it was protected only by a password, with no second factor. The password was reported to have appeared in a batch of leaked credentials, suggesting that the owner had used the same password elsewhere. It is not known exactly how the attackers obtained it, so that part should be treated as likely rather than proven.

The ransom

Within hours of the attack, Colonial's management decided to pay the criminals. The company paid 75 bitcoin, worth about 4.4 million US dollars at the time, and said it did so because it did not know how severe the damage was and wanted to restart quickly. The decryption tool the attackers provided was reportedly slow, and the company relied mainly on its own backups to restore systems.

In June 2021 the US Department of Justice announced that it had recovered about 63.7 bitcoin from a wallet it linked to the attackers, worth about 2.3 million dollars at the time of seizure. DarkSide announced soon after that it was closing down, though many of its affiliates moved to other groups.

The wider effects

• Panic buying. Demand for petrol surged, and many stations in the south-eastern states ran out.
• Government action. The Transportation Security Administration issued its first mandatory cybersecurity requirements for pipeline operators.
• Policy shift. The attack was among those that pushed the US administration to treat ransomware as a national security issue.

The small things that mattered

It would be easy to focus on the ransom and the fuel queues. The security lessons are more ordinary. First, an account nobody was using remained active, so it was a way in that nobody was watching. Second, there was no second factor on remote access. Third, there was a dependency between business systems and operations that forced a big decision under pressure. Each of these is cheap to fix before an incident and costly to deal with after.

To pay or not to pay

The decision to pay divided opinion. Law enforcement agencies generally advise against paying, since it funds further crime and offers no guarantee, while executives facing a shutdown of critical infrastructure often feel they have little choice. Blount defended the decision in testimony to the US Congress, saying that he wanted to get the pipeline running as quickly as possible and that it was one of the hardest decisions of his career. That the money was partly traced and recovered a few weeks later showed that cryptocurrency payments are not as anonymous as many criminals hope.

Whatever one thinks of the choice, the lesson is that it should be made in advance, not in the middle of a crisis. A business that has tested backups and a restoration plan can decide on its merits. A business without them is under pressure to pay whatever is asked.

Make a short written plan: who decides, who is called first, where the backups are and how long a restore would take. Even a one-page plan for a small website makes a real difference when something goes wrong at an awkward time.

The practical lesson for site owners

Switch on two-factor authentication for every login that can reach your site, hosting, email and domain. Remove accounts that are no longer needed, such as former employees and old freelancers, and never reuse passwords between services; a password manager makes this practical. Keep backups that are separate from your live systems so that you have a choice other than paying.

Our security page covers the protections available with our hosting, and our knowledge base explains how to turn on two-factor authentication in Plesk and review user accounts.