In May 2021, Americans were filling plastic bags with gasoline. Panic buying. Lines wrapped around the block. A regional state of emergency declared. Not because of a storm or a war, but because one VPN account, guarded by a single password and no second factor, got used by the wrong people.
Colonial Pipeline moves close to 45 percent of the fuel consumed on the entire US East Coast. On May 7, 2021, the ransomware group known as DarkSide got into Colonial's network. The company shut the pipeline down on its own. And a huge slice of a continent's fuel supply simply stopped moving.
It started with a single password
Here is the detail that should make every engineer physically wince. The attackers did not need a zero-day or some custom exploit. Investigators traced the entry back to one compromised VPN credential. A single account. The password was reportedly found inside a batch of leaked credentials, the kind that surfaces when people reuse the same password across services and one of those services gets breached somewhere else entirely.
That account was not even in active use anymore. But it was still enabled. And, critically, it had no multi-factor authentication in front of it. One password, and the door swung open.
I have written this line into nearly every security review I have ever delivered, and I will write it here too. MFA on that one forgotten account would very likely have stopped the entire incident. Not a million-dollar appliance. Not an AI defense platform. A second factor. The cheapest, most boring control we have in the entire toolbox.
Why shut the whole pipeline down?
Plenty of people asked why a fuel company would halt physical operations over a computer intrusion. The ransomware mainly hit the IT and billing side, not the industrial control systems directly. But Colonial could not reliably bill for fuel, and far more importantly, could not be certain how far the attackers had actually spread. When you cannot draw a clean, confident line between your compromised office network and the systems that run physical, flammable infrastructure, you stop everything. You assume the worst case. That is genuinely the responsible call, and it also quietly reveals how thin that boundary really was.
The ransom, and the plot twist
Colonial paid. Roughly 4.4 million dollars in Bitcoin, handed to DarkSide in exchange for decryption tools and an end to the pain. Here is the twist most people forget. About a month later, the US Department of Justice announced it had clawed back a large chunk of the money, somewhere around 2.3 million dollars, by tracing the cryptocurrency and seizing the wallet it flowed into. It turns out the blockchain that everyone loves to call "anonymous" is a permanent, public, searchable ledger. Funny how that detail only seems to matter to the criminals afterward.
The lesson nobody wants to hear
I come from the offensive side of this work, and honestly this breach is almost insulting in how simple it was. No elite tradecraft. No genius. A valid login on an abandoned account with no MFA, pointed at a company whose uptime an entire region quietly depends on.
The scale of the damage had almost nothing to do with the sophistication of the attack. It had everything to do with how brittle the target already was underneath. Critical national infrastructure sat one leaked password away from a real fuel crisis, and I would bet the attackers could not believe their own luck.
So yes, patch your systems. But before that, go turn on MFA absolutely everywhere, and go disable the accounts that nobody uses anymore. The boring cleanup list is exactly where the breaches live.
A nation's gas pumps ran dry because somebody, somewhere, reused a password. Let that single sentence be the whole security awareness training.
I am Ksatria Bintang Samudra, an AI-native full-stack engineer with a penetration-testing background and a deep interest in digital forensics, open to remote work worldwide. More of what I build at ksatriabintangsamudra.com.
Top comments (0)