Risk register · entry
Q3 · EngineeredColonial Pipeline shutdown
One leaked password shut the pipeline carrying 45% of East Coast fuel.
Tightly coupled systems where one small fault cascades and takes down the whole machine.
Why this quadrant
The trigger, one reused password on a forgotten VPN account, is about as simple and low-payoff a cause as risk gets, but it detonated inside a tightly coupled engineered system where office IT and physical fuel flow were interdependent, producing a fat-tailed cascade (national fuel panic, emergency waivers, new federal regulation) wildly disproportionate to the size of the original failure.
The record
- Colonial Pipeline carries approximately 45% of fuel consumed on the U.S. East Coastcertain
- Breach via compromised VPN password occurred around April 29, 2021; discovered by Colonial around 5:30 a.m. May 7, 2021likely
- Colonial shut down its entire 260-delivery-point pipeline within about an hour of discovery, May 7, 2021certain
- Ransom paid: 75 bitcoin, approximately $4.4 million, authorized by CEO Joseph Blount and paid May 8, 2021certain
- Approximately 100 GB of data exfiltrated before encryptionlikely
- Pipeline operations resumed May 12, 2021 (5 p.m.); full system normalization by May 15, 2021likely
- DOJ recovered 63.7 of the 75 bitcoin (about 84% of coins) on June 7, 2021, worth roughly $2.3 million at recovery-time pricescertain
- Approximately 10,600 U.S. gas stations reported out of fuel by May 18, 2021likely
- Charlotte, NC: 71% of stations out of fuel by May 11; Washington D.C.: 87% out of fuel by May 14, 2021likely
- U.S. national average gasoline price reached $3.04/gallon on May 18, 2021, a six-year highlikely
- DarkSide had earned an estimated $90 million from 47 victims in the year before the Colonial attackuncertain
- DarkSide announced shutdown weeks after the attack and reappeared as BlackMatter roughly two months later (July 2021)likely
- President Biden signed Executive Order 14028 on cybersecurity on May 12, 2021; TSA issued its first mandatory pipeline cybersecurity directive on May 28, 2021certain
Sources
The newsletter
One risk story a week, taken apart the way this one was: what was known, what was ignored, and which quadrant it really belonged to.
No spam, one email a week.