Colonial Pipeline: One Old VPN Password and a $4.4M Bitcoin Ransom

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

The Colonial Pipeline carries gasoline, diesel and jet fuel from Texas refineries through the Southeast to New York, about 45 percent of the fuel used on the East Coast. On May 6, 2021, the Russia-based group DarkSide stole 100 gigabytes of data, and on May 7 it deployed ransomware. The entry point was an inactive VPN account protected by a single password with no multi-factor authentication. The attack reached information technology systems such as billing, not the pumps, but Colonial shut down the physical pipeline out of fear the hackers could move into its operational technology.

Shortages spread through Alabama, Florida, Georgia, North Carolina, South Carolina, Virginia and Washington, D.C. By May 11, 71 percent of gas stations in Charlotte were empty, and by May 14, 87 percent in Washington were dry. The national average topped $3 a gallon, the highest since 2014, and the Consumer Product Safety Commission warned people not to fill plastic bags with gasoline. Within hours of the attack Colonial paid nearly 75 bitcoin, about $4.4 million; CEO Joseph Blount called it the right thing to do for the country. DarkSide's decryption tool was so slow that Colonial's own backups did more to restore systems. Operations restarted on May 12, and on June 7 the Justice Department and FBI announced the seizure of 63.7 bitcoin, worth about $2.3 million after a crypto crash.

• American Airlines added fuel stops to long-haul flights from Charlotte to Honolulu and London.
• DarkSide said in a statement that its goal was to make money and not to create problems for society.
• A blockchain analysis found DarkSide and its affiliates had collected $90 million in bitcoin from 47 victims, with developers taking about 17 percent.
• Senate hearings revealed Homeland Security was not alerted at first and the Justice Department was not told the ransomware type or payment.
• Regulators proposed a $986,400 penalty in 2022, and Executive Order 14028 tightened federal cybersecurity standards.