2021Ransomware
Colonial Pipeline ransomware attack
7 May 2021
A ransomware attack on Colonial Pipeline's business IT systems led the company to halt operations of its fuel pipeline, a major supplier to the US East Coast, as a precaution. The company paid a ransom, and the Department of Justice later recovered part of it.
- Victim
- Colonial Pipeline Company
- Sector
- Energy (fuel pipeline)
- Public attribution
- The FBI identified DarkSide ransomware; the US Department of Justice later seized part of the ransom paid to DarkSide.
Impact
Pipeline operations were halted. The US Department of Justice seized 63.7 bitcoins, then worth about 2.3 million US dollars, of the ransom payment.
Root cause
Colonial's CEO told the US Senate that the attackers used a legacy VPN account that had only single-factor authentication (reported by Dark Reading).
Lessons learned: the controls it teaches
- Require MFA on every remote access account and remove legacy accounts.
- Understand dependencies between IT and OT so a business-system outage does not force an operational shutdown.
- Engage law enforcement early; it can help trace and recover ransom payments.
Related exams
Sources
- US Department of Justice: Department of Justice seizes $2.3 million in cryptocurrency paid to the ransomware extortionists DarkSide
- CISA AA21-131A: DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks
- Dark Reading: Colonial Pipeline CEO: Ransomware attack started via pilfered 'legacy' VPN account