In May 2021, the largest fuel pipeline in the United States shut down, and thousands of gas stations ran dry. It all began with one password, on one old account that nobody was using anymore.
▶️ Subscribe to Elgon Web Hosting on YouTube for more Security Files episodes.
What happened
Colonial Pipeline runs about 5,500 miles from Houston, Texas, to New York Harbor, and carries roughly 45% of the fuel used on America’s East Coast. On April 29, 2021, hackers logged in to its network through a remote-access (VPN) account that was no longer in use but had never been switched off.
That account was protected by a single password, with no two-factor authentication. Investigators said the password was fairly complex, but it had also been used on other websites.
According to Bloomberg, the attackers copied nearly 100 GB of data, then released ransomware. On May 7, staff discovered the attack and shut the whole pipeline down within about an hour. The FBI linked the attack to the DarkSide ransomware group.
Colonial paid about 75 bitcoin, roughly $4.4 million at the time. The pipeline stayed shut for about six days, and at the peak more than 16,000 gas stations reported outages. In June, the U.S. Justice Department seized 63.7 bitcoin, worth about $2.3 million by then, because the price of bitcoin had fallen.
What your business can do today
- Turn on two-factor authentication everywhere, especially for email, hosting, remote access and admin accounts.
- Close old accounts. When someone leaves, or an account stops being used, switch it off.
- Never reuse passwords. A password manager makes this easy.
- Keep backups that hackers can’t reach, and test that you can restore them.
- Have a plan. Know who to call, and what to shut down, before it happens.