On May 7, 2021, Colonial Pipeline - the operator of the largest fuel pipeline in the United States, supplying approximately 45% of the gasoline, diesel, and jet fuel consumed on the US East Coast - shut down its entire pipeline operations after ransomware encrypted systems across its IT network. The pipeline carries 2.5 million barrels of fuel per day from refineries in Houston to terminals along the East Coast, serving markets from Texas to New York. The shutdown triggered fuel shortages across the Southeast United States within days, with gas stations running dry in North Carolina, Virginia, Georgia, and Florida. Panic buying amplified the shortage. The average US gasoline price hit a seven-year high. President Biden declared a state of emergency.

The ransomware group responsible was DarkSide, a Russian-linked RaaS operation. DarkSide had a "professional" public image in the ransomware ecosystem: it had a press center, published a code of conduct, avoided targeting hospitals and schools, and offered "charitable donations" from ransom proceeds (to distance itself from pure criminality in its messaging). None of that mattered when it hit the most critical piece of fuel infrastructure in the country and triggered a national emergency. Colonial paid $4.4 million in Bitcoin to DarkSide within hours of the attack, hoping to recover their data faster than their own backup restoration process would allow. The US government subsequently recovered approximately $2.3 million of the ransom through access to the DarkSide wallet.

The Initial Access: One Leaked Password

The Colonial Pipeline attack began with a single compromised VPN account. The account was a legacy VPN profile - it was not in active use, but it had not been deactivated. The password for this account appeared in a batch of leaked credentials available on the dark web, likely from a previous unrelated breach at a third-party service where the same password had been reused. The account did not have multi-factor authentication enabled.

DarkSide used the VPN credential to authenticate to Colonial Pipeline's network on April 29, 2021 - eight days before the ransomware deployment. During those eight days, operators moved laterally through the network, identified systems to encrypt, and staged the ransomware payload. When they deployed on May 7, they encrypted approximately 100 gigabytes of data in Colonial's corporate IT network within two hours and issued a ransom demand for approximately $4.4 million.

Colonial's operational technology (OT) network - the systems that physically controlled pipeline pumps, valves, and sensors - was not directly encrypted. Colonial shut the pipeline down voluntarily because the company could not verify the integrity of their billing and operational management systems. Without confidence in the IT systems that tracked fuel movement and customer billing, continuing pipeline operations was considered too risky from a liability and coordination standpoint. The physical pipeline was not compromised; the decision to halt it was precautionary.

[TECHNICAL NOTE]
The Colonial Pipeline incident highlighted the IT/OT convergence risk in critical infrastructure. Industrial control systems (ICS) and operational technology (the computers and networks that control physical processes) have historically been isolated from corporate IT networks. But the efficiency benefits of connecting OT to IT - remote monitoring, predictive maintenance, integrated billing - have driven increasing connectivity between the two environments. When Colonial shut down the pipeline due to IT encryption, it demonstrated that even without direct OT compromise, ransomware on IT systems can force operational shutdowns by undermining the management and billing systems that pipeline operations depend on. A truly air-gapped OT network would have allowed pipeline operations to continue while IT was restored. The cost of that connectivity benefit was the inability to operate when IT failed. CISA's ICS-CERT and the TSA (which regulates pipeline cybersecurity) both issued emergency directives post-Colonial requiring pipeline operators to implement specific cybersecurity measures and review IT/OT segmentation.

The Ransom Payment and Recovery

Colonial CEO Joseph Blount authorized the $4.4 million ransom payment on May 7, hours after the attack. The payment was made in Bitcoin to a DarkSide wallet. Blount later testified before Congress that he made the decision because the decryptor provided by DarkSide would supplement their own recovery efforts - the expectation was that the decryptor would be faster than restoring from backups. In practice, the decryptor was slow and Colonial's own restoration effort proceeded in parallel. The pipeline resumed partial operations on May 12 and was fully operational by May 15.

The more consequential part of the payment story was what happened next. The FBI had been working to recover the ransom. In early June, the DOJ announced that the FBI had successfully seized 63.7 Bitcoin (approximately $2.3 million at then-current prices) from the DarkSide wallet used to receive the payment. The DOJ obtained the private key to the wallet - the mechanism by which this was achieved was not fully disclosed, though the affidavit noted that the FBI had identified the wallet as belonging to DarkSide and that "law enforcement obtained the private key." This seizure was notable as one of the first successful ransom clawbacks by US law enforcement.

DarkSide announced on May 13 that it was shutting down operations, citing pressure from US law enforcement and the "loss of access to the servers" used for its blog and payment portal. The announcement was widely interpreted as a strategic retreat rather than a genuine disbanding - ransomware groups frequently rebranded under new names after high-profile incidents. DarkSide's operators were believed to have reconstituted as BlackMatter and subsequently as ALPHV/BlackCat.

[WARNING]
The Colonial Pipeline attack established a clear principle in ransomware policy debate: attacks on critical infrastructure - pipelines, hospitals, water systems, power grids - are treated categorically differently from attacks on enterprises. Before Colonial, US ransomware policy had largely treated ransomware as a financial crime matter. After Colonial, the Biden administration elevated ransomware to a national security concern, created the Ransomware Task Force, added ransomware groups to Treasury OFAC sanctions lists, and initiated diplomatic conversations about ransomware with Russia. The administration also issued executive guidance discouraging ransomware payments - though not prohibiting them - and required critical infrastructure operators to report ransomware attacks to CISA within 24 hours. The debate about whether ransom payments should be banned (to remove the financial incentive) versus remaining legal but regulated (to allow victims to recover) was intensified by Colonial but not resolved. A complete payment ban is opposed by many security practitioners on the grounds that it would push payments underground and leave victims without legal recourse.

The DarkSide Ecosystem

DarkSide was a Ransomware-as-a-Service operation that launched in August 2020. Its operators were believed to be based in Eastern Europe or Russia. The group was notable for a "professional" operational model: it offered a victim support chat, had a dedicated press center on the dark web for journalists to verify attacks, offered a "cyber insurance discount" to victims with confirmed cyber insurance coverage (implying they tracked this data), and published a list of targets it would not attack (hospitals, schools, non-profits, funeral homes). The professionalized approach was a marketing strategy - it made DarkSide appear more reliable to victims considering whether to pay.

The Colonial attack put DarkSide's affiliates - the actual operators who conducted the hack - in conflict with the DarkSide core team. The core team claimed the affiliate who hit Colonial acted without authorization and embarrassed the group. After DarkSide's announced shutdown, multiple former affiliates appeared to transition to ALPHV/BlackCat, which shared technical code with DarkSide. The ALPHV group went on to conduct the Change Healthcare attack in 2024, demonstrating the continuity of personnel and capability across RaaS rebrands.

[IOC]
DarkSide / Colonial Pipeline indicators: DarkSide ransomware dropped to disk as a unique per-victim binary with a hardcoded RSA public key; encrypted files received a random extension and a ransom note named "README.[extension].TXT". The ransom note directed victims to a DarkSide victim portal on Tor. DarkSide used a custom data exfiltration tool to steal data before encryption, enabling double extortion. Initial access at Colonial used compromised VPN credentials over the Pulse Secure/Ivanti VPN product; no MFA was configured. DarkSide C2 primarily used Cobalt Strike beacons with legitimate certificate infrastructure. The Bitcoin wallet that received the Colonial ransom: bc1qq2euq8pw950klpjcawuy4ys39j7x5509pqm0x3 (seized by FBI). DarkSide affiliate IDs and victim data appeared on the DarkSide blog at darksidc2iie3ki.onion (now defunct). TSA Security Directive Pipeline-2021-01 (issued May 27, 2021) required pipeline operators to report cybersecurity incidents to CISA within 12 hours and designate a cybersecurity coordinator.