Colonial Pipeline DarkSide ransomware

On the morning of May 7, 2021, Colonial Pipeline Company discovered DarkSide ransomware on its corporate IT and billing network. Initial access traced to an inactive VPN account, single-factor authenticated, whose password had been reused from an earlier unrelated breach. Within hours the company elected a precautionary shutdown of the entire 5,500-mile refined-products pipeline that delivers roughly 45 percent of East Coast fuel supply, on the basis that loss of billing visibility made continued operation impossible. CEO Joseph Blount authorized a 75 BTC (approximately $4.4 million) ransom payment on May 8; in June 2021 the US Department of Justice recovered 63.7 BTC of that payment. Pipeline restart began May 12, with normal flows restored by May 15. The shutdown produced cascading gasoline shortages across the southeastern United States, emergency fuel declarations in 18 states and DC, jet-fuel rationing at major airports, and panic-buying that itself worsened supply.

Six-day shutdown of the largest US refined-products pipeline; gasoline shortages and price spikes across the Southeast; emergency declarations in 18 states and DC; estimated economic impact in the hundreds of millions of dollars; $4.4 million paid ransom (with $2.3 million subsequently recovered by the DOJ); the incident drove the May 27, 2021 TSA Security Directive imposing the first mandatory pipeline cybersecurity requirements.