Colonial Pipeline 2021: a forgotten account and a fuel crisis

Nabayn did not work on this incident. This is our analysis of what is on the public record, written so other organisations can learn from it.

In May 2021, a ransomware attack led to a pipeline supplying nearly half the US East Coast’s fuel being shut down. Panic buying and price spikes followed in more than a dozen states. The route in was not a clever technical exploit. It was a remote access account that was not meant to be in use, with no second sign-in step.

What happened

Colonial Pipeline runs a 5,500-mile pipeline responsible for 45% of the East Coast’s fuel supply. In May 2021, the hijacking of its IT system led the company to shut the pipeline down. The incident sparked panic buying and spikes in gasoline prices in more than a dozen states.¹

The company’s chief executive, Joseph Blount, told the US Senate that the hackers, believed by the FBI to be a Russia-based group known as DarkSide, got in during late April. They used a compromised account to log in to the company’s virtual private network. He said the connection “was not intended to be in use”, and confirmed the account lacked multi-factor authentication.¹

The decision to pay

The company paid a ransom worth roughly $4.3 million in bitcoin. Blount called it “the hardest decision I’ve made in my 39 years in the energy industry”, and defended shutting the pipeline, saying it was absolutely the right decision. The Justice Department later announced that the FBI had recovered roughly $2.3 million worth of the payment.¹

What it raised

Senators questioned Blount about whether the pipeline could fall back on manual operations during a computer disruption, and whether the government should require companies to report cyber attacks.² It is worth noticing that the shutdown came from an attack on IT systems, and that it was the company that closed the pipeline.¹ When people cannot be sure what an attacker can reach, stopping everything can be the safest choice. It is also very costly.

What a small business can learn

Most of these lessons cost little or nothing. They are our suggestions.

Turn on two-step sign-in everywhere you can. A stolen password alone was enough here. Start with email and anything that gives remote access to your systems.

Close old accounts. When someone leaves or a system is retired, remove the access. Do this routinely, and check every few months. A forgotten account is easily missed, because nobody is watching it.

Keep a list of how people get in from outside. Remote desktop, VPNs, cloud admin logins and shared passwords should all be written down. You cannot protect a door you have forgotten exists.

Decide your position on ransom in advance. You do not want to be working this out for the first time during a crisis. The UK’s National Cyber Security Centre has a guide for small organisations, covering backups and protecting devices and accounts.³

Keep backups that an attacker cannot reach. Good, tested backups are what give you a real choice. Without them, you may have no option left.

Work out how you would keep trading. If your computers stopped today, could you still take orders and serve customers, even slowly? The senators’ question about manual fallback applies just as well to a small business. A printed list of tomorrow’s jobs can be very useful on a bad day.

Write down who to call. Include your IT support, insurer and bank, and keep a copy off your computers, because they may not be available when you need them.

If personal data is involved in an attack, you may also have legal duties to report it within 72 hours. See our guide to UK GDPR basics. For a wider checklist, read Cyber Essentials for small businesses.