Colonial Pipeline Ransomware Attack 2021: How One Unused VPN Account Shut Down a Fuel Pipeline

In May 2021, the DarkSide ransomware group forced Colonial Pipeline, one of the largest fuel pipeline operators in the United States, to shut down its pipeline system for six days. The way in was not an exploit. It was a single password for a VPN account that was no longer in use, still active, and not protected by multi-factor authentication. Colonial paid a ransom of about $4.4 million, part of which the US Justice Department later recovered. The attack is a human identity breach, but its root cause, an account nobody was using that nobody had switched off, is exactly the kind of orphaned identity that also plagues service accounts and API keys.

At a glance

What happened

On 7 May 2021, Colonial Pipeline proactively shut down its pipeline system in response to a ransomware attack, according to the US Department of Energy. The shutdown disrupted fuel supplies along the eastern seaboard, and federal agencies issued emergency fuel waivers across several states. The FBI confirmed on 10 May that the DarkSide ransomware group was responsible. Colonial restarted its entire pipeline system on 13 May.

Investigators later found that the attackers had been inside since as early as 29 April. According to Charles Carmakal of Mandiant, which led the incident response, they got in through a VPN account that was no longer being used but had never been disabled. The account's password turned up in a batch of leaked passwords on the dark web, though it was unclear how it was originally obtained. Before deploying ransomware, DarkSide exfiltrated nearly 100 GB of data to use as extortion leverage.

Colonial paid a ransom of about 75 bitcoin, worth roughly $4.4 million at the time, on 8 May. Testifying before the Senate Homeland Security and Governmental Affairs Committee on 8 June 2021, CEO Joseph Blount confirmed the attackers used a legacy VPN profile that lacked multi-factor authentication, and said the password was complex rather than simple. On the ransom, he said: "I made the decision to pay and I made the decision to keep the information about the payment as confidential as possible." The decryption tool helped but, in his words, was "not perfect".

On 7 June 2021, the Justice Department announced it had seized 63.7 bitcoin, then worth about $2.3 million, of the ransom paid to DarkSide.

Timeline

How it happened: the identity attack path

1. An account that outlived its purpose. A VPN profile was no longer used but remained enabled. Nobody was watching it, and no process removed it.
2. A leaked password. The account's password appeared in a leaked credentials batch on the dark web. Whether it was reused from another breach or stolen another way was not established publicly.
3. Single-factor remote access. The VPN accepted the password alone. A strong password did not help once it had leaked.
4. Dwell time. The attackers spent more than a week inside, long enough to find and exfiltrate nearly 100 GB of data.
5. Ransomware and a precautionary shutdown. Colonial shut down the pipeline system proactively once the ransomware was found, so the physical impact came from the company's decision to contain the attack rather than from attackers touching pipeline controls directly.

Impact

• Operations: the pipeline system was shut down from 7 to 13 May 2021, disrupting fuel supplies along the eastern seaboard and prompting federal emergency fuel waivers.
• Data: nearly 100 GB stolen for double extortion.
• Financial: about 75 bitcoin (around $4.4 million) paid, of which 63.7 bitcoin (about $2.3 million) was recovered by the Justice Department.
• Recovery: the CEO testified that seven financial systems were still down more than a month later.

What this means for identity security

Colonial Pipeline is on our list because it shows how a forgotten identity becomes an open door. The attackers did not beat any technical defence. They used an account that should not have existed, and the one control that would have stopped a leaked password, a second factor, was not there.

That pattern maps directly onto non-human identities. Organisations routinely hold service accounts, API keys and tokens that were created for a project, integration or person who has since moved on. Like Colonial's VPN profile, these credentials stay valid, often with broad access, and often with a static secret as the only protection. Our NHI Lifecycle Management Guide covers how to find and retire them.

The second lesson is that password strength is not the point. Blount noted the password was complex. Once a secret leaks, its complexity is irrelevant; only additional factors, short lifetimes or binding to a trusted device limit the damage. For machines, that means moving away from long-lived static secrets towards short-lived, federated credentials.

Recommendations

• Inventory and disable dormant accounts. Review remote-access accounts regularly and disable any that are unused. Apply the same to service accounts and API keys, with an owner for every identity. See IAM and IGA Basics.
• Require MFA on every remote-access path, including legacy VPN profiles and backup access routes that fall outside the main identity provider. Our Workforce Identity Security Guide explains how.
• Monitor for leaked credentials. Check your domains and accounts against breach and dark-web data, and force resets when credentials appear.
• Alert on use of dormant identities. A login from an account that has been unused for months is a high-signal event, for people and for machines.
• Separate business IT from operational technology, and plan how to keep critical operations running if IT systems are lost.
• Retire static secrets for machines. Use short-lived credentials and rotation for service accounts and keys, as covered in our guide to NHI rotation challenges.

Frequently asked questions

How did hackers get into Colonial Pipeline?

They logged in to a legacy VPN account that was no longer in use but still active, using a password that had leaked. The VPN did not require multi-factor authentication.

How much did Colonial Pipeline pay, and was it recovered?

Colonial paid about 75 bitcoin, roughly $4.4 million at the time. The US Justice Department seized 63.7 bitcoin, worth about $2.3 million, in June 2021.

Is Colonial Pipeline a non-human identity breach?

No, the account was a human VPN user account. We include it because a forgotten, still-active account with a single static secret is the same weakness that makes orphaned service accounts and API keys dangerous.

Related NHI Mgmt Group resources

SonicWall VPN accounts breach · Uber breach · Human vs Non-Human Identity · Top 10 NHI Issues

How NHI Mgmt Group can help

Dormant and orphaned identities are one of the most common root causes of breaches, whether they belong to people or machines. Our NHI Foundation Level Training Course shows teams how to discover, own and retire service accounts, API keys, tokens and other non-human identities before attackers find them.

References

• US Department of Energy: Colonial Pipeline Cyber Incident
• US Department of Justice: Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside (7 June 2021)
• Cybersecurity Dive: Colonial CEO says ransomware hackers exploited legacy VPN (9 June 2021), on the Senate testimony of 8 June 2021
• The Hacker News: Hackers Breached Colonial Pipeline Using Compromised VPN Password (June 2021), reporting Mandiant's findings
• World Oil: Ransomware attack shuts down biggest U.S. gasoline pipeline (9 May 2021)
• Dark Reading: Colonial Pipeline CEO: Ransomware Attack Started via Pilfered 'Legacy' VPN Account