Colonial Pipeline shutdown

One leaked password shut the pipeline carrying 45% of East Coast fuel.

Tightly coupled systems where one small fault cascades and takes down the whole machine.

Room: Q3 Engineered
Year: 2021
Impact: $4.4M
Sector: Energy logistics
Region: N. America
Category: Technological

Why this room

The trigger, one reused password on a forgotten VPN account, is about as simple and low-payoff a cause as risk gets, but it detonated inside a tightly coupled engineered system where office IT and physical fuel flow were quietly interdependent, producing a fat-tailed cascade (national fuel panic, emergency waivers, new federal regulation) wildly disproportionate to the size of the original failure.

The record

Colonial Pipeline carries approximately 45% of fuel consumed on the U.S. East Coastcertain
Breach via compromised VPN password occurred around April 29, 2021; discovered by Colonial around 5:30 a.m. May 7, 2021likely
Colonial shut down its entire 260-delivery-point pipeline within about an hour of discovery, May 7, 2021certain
Ransom paid: 75 bitcoin, approximately $4.4 million, authorized by CEO Joseph Blount and paid May 8, 2021certain
Approximately 100 GB of data exfiltrated before encryptionlikely
Pipeline operations resumed May 12, 2021 (5 p.m.); full system normalization by May 15, 2021likely
DOJ recovered 63.7 of the 75 bitcoin (about 84% of coins) on June 7, 2021, worth roughly $2.3 million at recovery-time pricescertain
Approximately 10,600 U.S. gas stations reported out of fuel by May 18, 2021likely
Charlotte, NC: 71% of stations out of fuel by May 11; Washington D.C.: 87% out of fuel by May 14, 2021likely
U.S. national average gasoline price reached $3.04/gallon on May 18, 2021, a six-year highlikely
DarkSide had earned an estimated $90 million from 47 victims in the year before the Colonial attackuncertain
DarkSide announced shutdown weeks after the attack and reappeared as BlackMatter roughly two months later (July 2021)likely
President Biden signed Executive Order 14028 on cybersecurity on May 12, 2021; TSA issued its first mandatory pipeline cybersecurity directive on May 28, 2021certain

Sources

The book

This entry is one of 111 in the register. The full story, and what it cost the people who lived it, is in Risky Business by Claudia Zeisberger, David Munro and Joanna Reijgersberg-Siew.

Join the waiting list