Case study · Energy
Colonial Pipeline: ransomware that cut the fuel supply
United States, 2021. A compromised VPN password leads to the shutdown of the country's largest refined-fuel pipeline.
In one sentenceOne VPN password without a second factor was enough to stop a pipeline: the company could not show that the operational side was safe.
- Sector
- Fuel transport
- Country
- United States
- Date
- May 2021
- Duration
- Pipeline stopped 7–12 May
- Ransom
- About $4.4m ($2.3m recovered)
Analysis based solely on public information. FZ Consultation was not involved in this incident and has no affiliation with the organizations named.
What happened
- 29 April 2021
Attackers gain access to the company's IT network, nine days before the attack.
- 7 May 2021
An operator finds a ransom note. The company shuts down its entire 5,500-mile pipeline as a precaution, even though operational systems were not directly hit.
- 7 May 2021
The company pays a ransom of about $4.4m in bitcoin for a decryption tool.
- 12 May 2021
The pipeline restarts, after fuel shortages and price spikes on the East Coast.
- 7 June 2021
The Justice Department announces it recovered about $2.3m of the ransom.
What went wrong
According to the public sources listed below.
Poorly protected remote access
Initial access came through a compromised VPN password, on an account that, according to public reports, had no multi-factor authentication and was no longer in use.
An uncertain IT/OT boundary
Without certainty about the extent of the compromise, the company stopped physical operations although only the IT network was hit.
Recovery dependent on the ransom
The ransom was paid to speed up recovery, a sign that restoring from backups alone could not meet the required timeframe.
Lessons for your organization
- 1
MFA on every remote access
And regular removal of inactive accounts, especially those with VPN access.
Prepare: recovery that holds - 2
Segment and know your dependencies
Know in advance whether operations can continue when IT is isolated, and on what criteria to stop.
Know: measure what stopping would cost - 3
Be able to restore without paying
Isolated backups and tested restores give you the choice not to negotiate.
Prepare: recovery that holds
Check on Monday morning
Three questions to put to your own organization this week. If you cannot answer one of them in five minutes, that is your first task.
- List every remote access path (VPN, remote desktop, portals). Which ones do not require multi-factor authentication?
- Disable inactive accounts, especially those with VPN access.
- If your IT systems were isolated tomorrow, could operations continue, and on what criterion would you decide to stop?
Sources
More case studies
- AWS us-east-1: one empty DNS record, a day of cascading failuresWorldwide, October 2025. A race condition in DynamoDB's DNS automation leaves a region without an address, and many services fall with it.
- Jaguar Land Rover: weeks of idle factories and a state-backed loanUK, 2025. A cyberattack stops production for weeks and reaches over 5,000 organisations across the supply chain.
- Collins Aerospace: one check-in system, four airports on paperEurope, September 2025. Ransomware hits a shared check-in system and forces Heathrow, Brussels, Berlin and Dublin onto manual processes.