Colonial Pipeline: The Single Password That Shut Down East Coast Fuel Supply

On May 8, 2021, Colonial Pipeline Company shut down approximately 5,500 miles of fuel pipeline carrying 45% of the East Coast's fuel supply - jet fuel, gasoline, heating oil - from Houston, Texas to New Jersey. The cause was a ransomware attack. The shutdown was a precautionary decision: the operational technology systems that controlled the physical pipeline had not been encrypted, but management was concerned enough about the situation to take the entire system offline rather than risk losing control of it.

The result was a fuel crisis affecting eleven states. Gas prices spiked. Stations ran out. Drivers queued for hours. The Governor of North Carolina declared a state of emergency. The President of the United States signed an executive order waiving regulations on fuel transport to enable alternatives. Six days after the attack, after Colonial had paid $4.4 million in ransom, the pipeline came back online.

//The Entry Point: A Single Password

The FBI investigation traced the initial access to a single compromised VPN account. An employee's credentials - username and password for a legacy VPN system that was no longer in active use but had not been decommissioned - had been acquired by the attackers, likely through a data broker or previous breach database. The account did not have multi-factor authentication enabled.

This is the technical summary of the most disruptive infrastructure attack on the United States in recent history: someone had a leaked password for an old VPN account, and that account had no second factor. Everything that followed - the network access, the data theft, the ransomware deployment, the pipeline shutdown, the fuel crisis - flowed from that single failure.

The attackers, a ransomware-as-a-service group called DarkSide, had been operating since August 2020. They were not a nation-state. They were a criminal enterprise offering their ransomware toolkit to affiliates who conducted attacks in exchange for a percentage of the ransom. The affiliates kept 75-80% of proceeds; DarkSide kept the rest and provided the malware, the negotiation platform, and the data leak site.

//DarkSide and the RaaS Model

DarkSide's business model was sophisticated and, in its own terms, professionally run. They had a published "code of ethics" that prohibited attacks on hospitals, schools, non-profits, and government agencies - partly as self-regulation to avoid political pressure, partly as brand positioning. They claimed to donate portions of their earnings to charity.

The ransomware itself was technically proficient. It encrypted files on infected Windows systems using a combination of RSA and ChaCha20, a fast stream cipher. DarkSide used a "double extortion" model: before encrypting files, they exfiltrated data to their servers. If the victim did not pay, the stolen data would be published on their leak site. Colonial Pipeline's case involved both file encryption and data exfiltration - approximately 100 GB of data was taken.

//The IT/OT Question

The decision to shut down the physical pipeline was Colonial's, not the attackers'. DarkSide had encrypted files on Colonial's IT (information technology) network - the business systems, billing, financial applications, corporate computers. They had not reached the OT (operational technology) network that directly controlled the pipeline's physical operation.

But the IT and OT networks were connected. Colonial management made the judgment that they could not safely operate the pipeline without confidence in the billing systems - both to ensure they could accurately charge customers for fuel, and because they were uncertain about what else the attackers might have access to. They shut down the pipeline proactively.

This decision revealed a fundamental vulnerability in critical infrastructure: the business systems and the physical control systems, though conceptually separate, were operationally interdependent. Even a ransomware attack that never touched the SCADA systems controlling the physical pipeline caused an outage. The adversary did not need to compromise the physical infrastructure - they just needed to make the operators uncertain enough about their digital environment that the operators took it offline themselves.

//The Fuel Crisis

The pipeline supplied roughly 45% of fuel for the US East Coast. The shutdown lasted six days: May 7 to May 13. During that time, fuel supplies that had been in the pipeline when it stopped were delivered. After that, supply chains began tightening.

The panic response from consumers amplified the disruption significantly. News of the shutdown prompted hoarding: people filled cars, gas cans, and - in some widely circulated images - plastic bags with gasoline. This accelerated the depletion of available supply at gas stations in the Southeast and East Coast. Patrick De Haan, head of petroleum analysis at GasBuddy, publicly urged people not to hoard fuel, noting that the panic response was doing more damage than the supply disruption itself.

Average gas prices rose above $3 per gallon nationally for the first time since 2014. In some states, prices approached $3.50. The White House waived the Jones Act to allow non-US ships to carry fuel between ports. The Department of Transportation waived hours-of-service regulations for fuel truck drivers. These measures helped but could not fully compensate for a pipeline that moved 2.5 million barrels of fuel per day.

//The Ransom Payment

Colonial Pipeline paid DarkSide $4.4 million in Bitcoin on May 7 or 8 - apparently before the public knew the extent of the situation. The payment was made in approximately 75 Bitcoin at prevailing exchange rates. The CEO of Colonial Pipeline, Joseph Blount, later testified to Congress that he had authorised the payment without consulting the FBI or CISA, and without notifying shareholders or the public at the time.

The decryption tool provided by DarkSide worked, but was reportedly slow - Colonial executives said they found their own backup restoration process faster than decrypting with the provided key. The FBI was notified of the payment after it occurred.

//The FBI Recovery

On June 7, 2021 - less than a month after the attack - the Department of Justice announced that it had recovered 63.7 Bitcoin from the ransom payment, approximately $2.3 million at then-prevailing prices. This was an extraordinary result. Ransomware payments are typically unrecoverable.

The recovery was accomplished by identifying the Bitcoin wallet that had received the ransom payment and obtaining the private key to that wallet. The DOJ did not explain how they had obtained the private key, citing ongoing law enforcement methods. Speculation centred on the possibility that DarkSide's payment infrastructure used a cloud-hosted wallet whose private key was accessible, or that law enforcement had already penetrated DarkSide's infrastructure before the Colonial attack.

The DOJ announcement noted that DarkSide operated as what they called a "cryptocurrency wallet" that was accessible to law enforcement - implying that the wallet was hosted in a manner that US law enforcement could access. The announcement was carefully worded to avoid revealing the specific technique.

//DarkSide's Collapse

Within days of the Colonial Pipeline attack becoming public, DarkSide's operations collapsed. Their servers were seized. Their cryptocurrency was drained - apparently either by law enforcement or by a third party who gained access to DarkSide's infrastructure during the chaos. DarkSide posted a message to their affiliates saying they had "lost access" to their infrastructure and were shutting down.

The shutdown was widely understood to be a result of US government pressure on Russia, where DarkSide's operators were based. The FBI and NSA publicly attributed the attack; the Biden administration raised the matter directly with the Russian government. Whether the Russian government took action to shut down DarkSide or simply withdrew the protection that had allowed them to operate is not publicly known.

DarkSide rebranded as BlackMatter within months and resumed operations. BlackMatter was subsequently shut down under similar circumstances. The ransomware ecosystem is resilient: groups disband, rebrand, and reform continuously, often with the same core personnel.

The Password That Brought Down a Pipeline

The Colonial Pipeline attack became a landmark case in critical infrastructure security discussions not because it was technically sophisticated - it was not - but because it demonstrated the asymmetry between the effort required to cause disruption and the consequences of that disruption. A single credential from a breach database, used on an old VPN account without MFA, caused a six-day shutdown of the largest fuel pipeline in the United States, a national fuel emergency, and $4.4 million in ransom. The cost of enabling MFA on every account would have been measured in administrator-hours. The cost of not doing so was measured in national emergency declarations.