The Colonial Pipeline Attack (2021) - One Password Shut Down a Country's Fuel Supply

The Attack That Made Ransomware Real

In 2021, the Colonial Pipeline - the largest fuel pipeline in the United States, supplying over 40% of the East Coast's gasoline - shut down completely.

The cause: ransomware. Attackers had locked the company's IT systems and demanded money to unlock them. Colonial couldn't risk the malware spreading to their operational systems, so they shut down the entire pipeline.

The result: gas stations from the south of US up to New York ran dry. People panic-bought fuel in garbage bags. Airlines had to adjust flight routes. The government declared a state of emergency.

Everything started with one password.

The Attack Chain

Let's break this down like we did with the Target breach.


Stage 1: Initial Access — One Leaked Password


Attackers used a leaked password-

The password belonged to a Colonial employee's VPN account. VPNs let employees access company systems remotely. The password had been reused on another site that got breached, and it ended up in a leaked password database.

Attackers found that password, tried it, and it worked.

No MFA. No second factor. Just one password was enough.


Stage 2: The Ransomware


The ransomware was called DarkSide. The core developers created the malware, and affiliates used it to attack targets. Profits were split.

DarkSide was professional and had:

They claimed to be apolitical and financially motivated.


Stage 3: The Attack and Shutdown


On May 7, 2021, DarkSide ransomware hit Colonial's IT network. It encrypted files and demanded a ransom — reportedly $4.4 million.

Colonial's response: shut down the entire pipeline. Not just the IT systems — the physical pipeline itself. 5,500 miles of pipeline carrying 2.5 million barrels of fuel per day went offline.

Why shut down the physical pipeline? Because the IT systems controlled billing, scheduling, and monitoring. Without those, they couldn't safely operate. And they couldn't risk the ransomware spreading to the industrial control systems that actually move the fuel.


Stage 4: Panic and Shortages


The shutdown lasted six days. Six days without 45% of the East Coast's fuel supply.

The result:


Stage 5: The Ransom Payment


Colonial paid the ransom — approximately $4.4 million in Bitcoin — on May 7, 2021.

Why pay? Because decryption was taking too long. The attackers provided a decryption tool, but it was so slow that Colonial's own backups were faster. But the backups weren't complete either, and the pipeline was losing millions every hour it stayed shut.

The FBI recovered $2.3 million of the ransom later — tracking the Bitcoin transactions and seizing the cryptocurrency from the attackers' wallet. But the other half was never recovered.


Stage 6: Aftermath


The Colonial Pipeline attack changed everything:

Why This One Was Different

Before Colonial, ransomware mostly hit hospitals, schools, and businesses. Disruptive, expensive, but contained.

Colonial showed that ransomware could hit critical infrastructure — the systems society depends on. If one password can shut down a fuel pipeline, what about the power grid? Water treatment? Emergency services?