The Colonial Pipeline attack, five years later

About this series

What happened in May 2021

In May 2021, the largest fuel pipeline in the United States stopped moving gas. For six days, Colonial Pipeline shut down its 5,500-mile system that carries nearly half the East Coast's fuel supply. The cause was a Ransomware (show definition) attack by a group known as DarkSide.

The shutdown led to fuel shortages across the Southeast. Gas stations ran dry, and panic-buying drove prices up as consumers feared a long-term disruption. The company eventually paid roughly 4.4 million dollars in Bitcoin to the attackers to get a decryption key, though the FBI later recovered a significant portion of those funds.

The single point of failure

The entry point was not a complex exploit or a high-tech breach. It was a single legacy VPN account. This account was no longer in active use, but it was still active in the system. The password had been compromised in a previous data breach elsewhere.

Crucially, this account did not have Multi-factor authentication (MFA) (show definition) enabled. Because the account only required a username and password, the attackers were able to log in as if they were a legitimate employee. From that one entry point, they were able to move through the network and deploy their ransomware.

For many small businesses, this is the most important lesson. You may have strong security on your primary accounts, but an old, forgotten account for a former contractor or a retired system can serve as an open door if it isn't closed or protected with MFA.

Segmentation and the decision to shut down

One of the most debated parts of the incident was why the pipeline itself was shut down. The ransomware hit the business side of the network—the systems used for billing, accounting, and general office work. It did not directly infect the operational technology (OT) that controls the physical movement of fuel.

However, Colonial Pipeline chose to shut down the pipeline because their billing systems were offline. They could move fuel, but they could not track who was receiving it or how to bill for it. Furthermore, they were not entirely sure if the attackers could move from the business network into the operational network.

This highlights the importance of network segmentation. If your critical operations are tightly coupled with your business systems, a problem in your email or accounting software can force you to stop producing or delivering. True segmentation ensures that even if your office computers are locked, your shop floor or delivery fleet can keep moving safely.

Recovery is more than just backups

Colonial Pipeline did have backups, and they did receive a decryption tool after paying the ransom. But recovery was still agonizingly slow. The decryption tool provided by the attackers was inefficient, and the process of restoring massive amounts of data took days that the company—and the public—didn't have.

For a mid-sized business, this proves that having a backup is only half the battle. You must also know how long it takes to restore. If your business depends on daily operations, a recovery process that takes a week is often as damaging as losing the data entirely.

A checklist for operational resilience

• Audit all remote access accounts (VPN, RDP) and ensure MFA is mandatory for every single one.
• Identify and disable legacy accounts for former employees, contractors, or retired systems.
• Test your Incident response plan (show definition) specifically for a scenario where your billing or scheduling systems go dark.
• Run a restore test on your most critical data and measure exactly how many hours it takes to get back to full speed.
• Separate your operational systems (like CNC machines or dispatch tools) from your general office Wi-Fi and network.

What this means for you today

Five years later, the tactics used against Colonial Pipeline are still the bread and butter of cybercriminal groups. They look for the easiest way in—usually a stolen password—and they aim for businesses where downtime creates the most pressure to pay.

If your business moves physical goods or provides essential field services, you are in the crosshairs. The solution is not to build a perfect wall, but to ensure that one small crack doesn't bring down the entire house.