Research Library
Colonial Pipeline Ransomware Attack 2021
On 7 May 2021, Colonial Pipeline shut down the largest fuel pipeline in the United States after a ransomware attack on its IT systems. The pipeline itself was never infected — the shutdown was precautionary. This case study covers only confirmed facts, attributed and dated.
What happened, in brief
Colonial Pipeline operates about 5,500 miles of pipeline carrying gasoline, diesel and jet fuel — roughly 45% of the fuel consumed on the US East Coast. On 7 May 2021 the company discovered a ransom note on its corporate IT network: ransomware attributed to the DarkSide group had encrypted its business systems. The company shut down the entire pipeline system the same day, as a precaution. The FBI was notified on 9 May and confirmed on 10 May that DarkSide ransomware was responsible. Colonial Pipeline restarted operations on 12 May and announced on 13 May that it had restarted its entire system and deliveries had begun to all markets.
The shutdown, not the malware, is what the public felt. Fuel stopped flowing for about five days, panic buying set in across the south-eastern United States, petrol stations ran dry, and average fuel prices rose to their highest level since 2014, according to contemporary reporting. Emergency declarations were issued in multiple states and at federal level.
Timeline of confirmed events
- 6–7 May 2021: attackers deploy DarkSide ransomware on Colonial Pipeline's IT network; the company discovers the ransom note and shuts down the pipeline system.
- 9 May 2021: the FBI is notified of the disruption; a federal emergency declaration is issued.
- 10 May 2021: the FBI confirms DarkSide ransomware is responsible for the compromise.
- 11 May 2021: CISA and the FBI publish joint advisory AA21-131A on DarkSide ransomware.
- 12 May 2021: pipeline operations restart; the company pays a ransom of about 75 bitcoin (around $4.4 million at the time).
- 13 May 2021: Colonial Pipeline announces the entire system has restarted and deliveries have begun to all markets.
- 14 May 2021: DarkSide's operators shut down the operation, according to public reporting, after stating the attack was financially motivated.
- 7 June 2021: the US Department of Justice announces it has recovered about 63.7 bitcoin — around $2.3 million — of the ransom payment.
- May–July 2021: the Transportation Security Administration issues its first mandatory cybersecurity directives for pipeline operators.
How the attackers got in
According to Mandiant, the incident-response firm brought in to investigate, the attackers gained initial access through a legacy virtual private network (VPN) account that was still active but no longer meant to be in use. The account had no multi-factor authentication, and a single compromised password was enough to get in. The password is reported to have come from a previous data breach — the exact source of the credential was not publicly confirmed, and this case study does not assert it.
Once inside, the attackers stole about 100 gigabytes of data within a two-hour window, according to reporting of the investigation, and then deployed ransomware across the IT network, encrypting systems including billing and accounting. The ransom note, the encryption, and the theft together made this a double-extortion attack: pay for the decryption key, and pay to stop the stolen data being published.
IT versus OT: the distinction that matters
The most important technical fact of this case is also the most misunderstood: the pipeline's operational technology — the systems that physically move fuel — was never infected. CISA and the FBI's joint advisory states there was no indication that OT networks were directly affected and no sign the attackers moved laterally into OT. Colonial Pipeline disconnected certain OT systems as a safety measure, and chose to shut the pipeline down because it could not confidently bill and track the fuel it moved while its business systems were compromised, and could not be certain the infection would stay contained.
That decision was the right one under uncertainty, and it is also the reason the incident became a national event: an IT ransomware attack stopped a physical operation without ever touching the physical systems. It is the clearest public demonstration that the separation between IT and OT is a business and safety decision, not only a technical one.
The ransom, and the recovery
Colonial Pipeline paid about 75 bitcoin, worth around $4.4 million at the time, to obtain the decryption key. The company's chief executive later confirmed the payment publicly and said the company did not know at the time how badly its systems were damaged or how long recovery would take. The decryption tool provided was, by contemporary reporting, slow and of limited use — the company's own backups and recovery work restored operations faster than the tool did.
In June 2021 the US Department of Justice announced it had seized about 63.7 of the bitcoin paid — around $2.3 million by then, after the bitcoin price had fallen — using a court-authorised seizure of the wallet holding the payment. The recovery, carried out with the FBI, demonstrated that cryptocurrency payments can be traced and in some cases recovered, though that outcome is not typical and should not be treated as a reason to pay.
Attribution: what is confirmed
The FBI stated on 10 May 2021 that DarkSide ransomware was responsible for the compromise of Colonial Pipeline's networks, and the joint CISA/FBI advisory of 11 May 2021 names DarkSide actors as the group that deployed the ransomware. DarkSide operated as a ransomware-as-a-service group — a core team providing the ransomware to affiliates who carried out attacks. Reporting on the group's location describes it as widely reported to be based in Russia or Eastern Europe; this case study does not assert a location as confirmed fact, because no government statement in the sources used confirms it. The operators publicly stated the attack was financially motivated and apolitical before shutting the operation down.
What changed afterwards
The attack became a catalyst for US policy. The Transportation Security Administration issued its first mandatory cybersecurity directives for pipeline operators — replacing voluntary guidance with specific requirements on incident reporting, a named cybersecurity coordinator, and security assessments — the first in late May 2021 and a more detailed one in July. The incident also fed into Executive Order 14028, issued on 12 May 2021, on improving the nation's cybersecurity. For operators of critical infrastructure worldwide, the lesson was concrete: a single legacy account without multi-factor authentication can stop a national fuel supply, and the controls that prevent that — disabling unused accounts, requiring multi-factor authentication on all remote access, and segmenting IT from OT — are basic, inexpensive, and overdue wherever they are missing.
For the concepts behind this case, see our guides to MITRE ATT&CK (how the attack maps to tactics and techniques) and what a CVE is.
Sources
- CISA and FBI — Joint Cybersecurity Advisory AA21-131A, DarkSide Ransomware (11 May 2021)
- FBI — Statement on compromise of Colonial Pipeline networks (10 May 2021)
- US Department of Justice — seizure of $2.3 million in cryptocurrency paid to DarkSide (7 June 2021)
- Mandiant — investigation findings as reported (compromised VPN account without MFA)
Frequently asked questions
What happened in the Colonial Pipeline attack?
On 7 May 2021 Colonial Pipeline discovered ransomware on its corporate IT network, attributed by the FBI to the DarkSide group. The company shut down its pipeline system as a precaution. Operations restarted on 12–13 May 2021.
Was the pipeline itself hacked?
No. CISA and the FBI reported no indication that the operational technology (OT) systems that move fuel were directly affected. The attackers hit the IT network — billing and business systems — and the company shut the pipeline down because it could not be certain the infection would stay on the IT side.
How did the attackers get in?
According to Mandiant's investigation, reported widely, the attackers used a compromised password for a legacy VPN account that was still active and had no multi-factor authentication. The password is reported to have come from an earlier data breach.
How much ransom did Colonial Pipeline pay?
The company paid about 75 bitcoin, worth around $4.4 million at the time. In June 2021 the US Department of Justice announced it had recovered about 63.7 bitcoin, worth around $2.3 million at that time.
Who was behind the attack?
The FBI confirmed on 10 May 2021 that the DarkSide ransomware was responsible. DarkSide was a ransomware-as-a-service operation; its operators later said the attack was financially motivated and shut the operation down on 14 May 2021, according to public reporting.
What changed after Colonial Pipeline?
The incident led to the first mandatory US cybersecurity directives for pipeline operators from the Transportation Security Administration, and it was a catalyst for the US Executive Order 14028 on improving national cybersecurity.