Scourge · May 7 2021

The Scourge of the Pipeline

Chronicle

On 7 May 2021 DarkSide ransomware hit Colonial Pipeline's IT network, and the company shut down the largest fuel pipeline in the US as a precaution for several days. Panic buying broke out along the Southeast coast and many filling stations ran dry. The attackers had come in through an old VPN account without multi-factor authentication, whose password had leaked. Colonial paid about 75 bitcoin; DarkSide then declared that its goal was to make money, not to create problems for society, as if a halted pipeline were a side effect.

Lesson learned

It turned ransomware into a US national security issue and led to new rules for pipeline operators. It also showed that an attack on office IT can stop physical operations.

Prayer of reparation

O DarkSide, who claimed to want only money and no trouble, learn that you can't shut a pipeline without consequences, and teach us to switch off forgotten VPN accounts. Amen.

How it is remembered

Remembered by disabling accounts nobody uses any more, requiring MFA on all remote access and separating office networks from the ones that move fuel.