March 18, 2026, 2:35 p.m.

"On the morning of May 7, 2021, millions of drivers on the US East Coast saw gas stations beginning to close. The reason? A single employee's old password."

Colonial Pipeline was the largest pipeline operator carrying 2.5 million barrels of fuel daily to the US East Coast. This 8,850-kilometer infrastructure stretching from Texas to New York carries approximately 45% of the region's fuel. In 2021, an attack on this critical infrastructure plunged an entire country into a fuel supply crisis.

Colonial Pipeline: The pipeline feeding the US East Coast was paralyzed by ransomware

How Did It Happen? It Started with an Old Password

The investigation revealed a shocking result: The attackers entered the system through VPN. And the password used for this VPN account was available in leaked data packages sold on the dark web.

• The VPN account in question was no longer actively used — but had not been closed
• The account had no multi-factor authentication (MFA)
• The DarkSide ransomware group entered the network with this single account and stole 100 GB of data
• They then encrypted systems and demanded ransom

Chaos: Nationwide Fuel Panic

• 🔴 Upon detecting the attack, Colonial Pipeline completely shut down the pipeline
• 🔴 Fuel shortages began on the US East Coast
• 🔴 Thousands of gas stations posted "No Fuel" signs
• 🔴 Joe Biden's administration declared a national emergency
• 🔴 Flights began to be disrupted, prices rose rapidly
• 🔴 The company paid $4.4 million in ransom to bring the system back online

Interesting note: The FBI managed to recover a large portion of the ransom paid ($2.3 million) from DarkSide's crypto wallet. But this did not reverse the damage.

Why Is Critical Infrastructure Security Different?

This case shows why critical infrastructure security requires a special approach:

• If a bank is hacked, money is lost. If a pipeline is hacked, hospitals run out of fuel, planes can't fly.
• OT (Operational Technology) systems are often years behind IT security standards
• Even emergency shutdown decisions can have severe consequences

Lessons Learned

• ✅ Close unused accounts: Old employee and legacy system accounts should be regularly cleaned up
• ✅ MFA must be mandatory for VPN access: Passwords alone are not enough
• ✅ Implement dark web monitoring: Have your employee credentials been leaked?
• ✅ OT/IT segmentation: Operational systems should be isolated from office networks
• ✅ Before ransom payment planning: Insurance, legal counsel, and negotiation plans should be ready

Contact Nordis Global for a critical infrastructure security assessment.