In May 2021, the most dangerous object on the East Coast of the United States was not a pipeline. It was a plastic bag.
People were filling them with gasoline. Not jerry cans, which are at least designed to hold fuel and merely frowned upon. Bags. Grocery bags, trash bags, whatever was in the trunk. The US Consumer Product Safety Commission, an agency whose usual beat is warning people about wobbly ladders, had to issue a public statement asking Americans to please stop putting gasoline in plastic bags. Stations across the Southeast ran dry by the thousands. Lines wrapped around blocks. Prices climbed past three dollars a gallon nationally for the first time in years. Governors declared emergencies. The federal government declared one too.
Underneath all of that theater sat a genuinely strange fact: for most of the people in those lines, the fuel was probably going to be fine. The pipeline at the center of the panic had been shut down for days, not weeks, and fuel moves by truck and barge and rail as well as by pipe. What emptied the stations was not the shutdown. It was everyone deciding, at the same time, that the shutdown was about to empty the stations. The shortage was a self-fulfilling prophecy with a line at the pump.
And underneath the panic sat a stranger fact still. The whole cascade, the emergencies, the lines, the bags, the very serious federal warning about bags, started with a single password. One password, for one old account, on one old door into the network, a door that had exactly one lock on it and had been left standing open to the internet long after everyone had stopped using it.
This is the story of the Colonial Pipeline ransomware attack, and it is worth telling slowly, because almost everything the public remembers about it is the least important part. The ransomware was not the interesting failure. The interesting failure was an account nobody had bothered to delete.
The door
Colonial Pipeline is not a household name, but it should be, because a large share of the East Coast runs on it. The system runs about 5,500 miles from the Gulf Coast up to the New York harbor area and carries about 45 percent of the fuel the eastern half of the country burns: gasoline, diesel, jet fuel, roughly 2.5 million barrels a day. If you flew out of Atlanta or Charlotte or Washington that spring, there was a decent chance the jet fuel in the wing had come up that pipe. If you drove anywhere in the Southeast, same story at one remove.
Companies like Colonial maintain many doors into their networks. Employees working remotely need a way in, so there are VPN accounts, each one a credential that says: whoever presents this may enter. Modern practice puts two locks on those doors. The first is a password. The second is multifactor authentication: a code from a token or a phone, something you have in addition to something you know. The point of the second lock is precisely calibrated to the most common disaster in security, which is that passwords escape. They get phished, reused, harvested from other companies' breaches, and sold in bulk. A password that has escaped is not a secret anymore. It is a rumor. The second factor is what keeps a rumor from becoming a key.
Colonial had a legacy VPN profile, an older remote access setup from an earlier era of the company's systems. It had one lock. When the company's CEO, Joseph Blount, sat in front of the Senate Homeland Security Committee a month after the attack, a senator asked him about it directly, and his answer is the whole incident in one sentence: "In the case of this particular legacy VPN, it only had single-factor authentication."
He was careful to add that the password itself was strong. "It was a complicated password," he testified. "I want to be clear on that. It was not a Colonial123-type password." This is true, and it matters, and it did not help at all. Investigators working the case found that the password had surfaced in a batch of leaked credentials circulating on the dark web, the kind of aggregated dump assembled from other breaches. Nobody has ever publicly established exactly where it leaked from. It does not matter. A strong password that has leaked is a strong password that everyone has. Strength is a property of a secret. Once it is published in a dump, it is not a secret with good posture. It is just a string.
The second fact about the account is the one that should be printed on posters. Per Blount's own written testimony: "We believe the attacker exploited a legacy virtual private network (VPN) profile that was not intended to be in use." Read that again. The door was not a door anyone was using. It was a leftover. The account sat there, enabled, reachable, holding valid credentials into the network of the company that moves nearly half the East Coast's fuel, protected by one leaked password, waiting patiently for whoever found the dump first.
Somebody did. The intruders, an affiliate working with the DarkSide ransomware operation, were inside Colonial's network by late April 2021. Before they ever deployed ransomware, they did what professional extortionists do: they stole the leverage. Over a few hours on May 6, they exfiltrated roughly 100 gigabytes of company data. Then, in the early morning of May 7, the ransomware went off across Colonial's information technology systems, encrypting the business side of the house, including systems the company relied on to bill and account for the fuel moving through its pipes.
An employee found a ransom note on a computer at about 5:00 in the morning. Blount was notified within the hour. And then Colonial Pipeline made the decision that turned a serious corporate IT incident into a national event.
The shutdown
Here is the part most retellings get wrong, usually by implying the hackers stopped the pipeline. They did not. Colonial stopped the pipeline.
The ransomware had hit the IT network: the office systems, the business systems. The operational technology, the control systems that physically run the pipe, open and close valves, and watch pressures, was not shown to be compromised. But Colonial could not be sure of that in the first hours, and there is a second problem that gets less attention: a pipeline company that cannot account for its product has a business problem even with healthy valves. In testimony, Blount described a company that could not verify the integrity of everything downstream of a breached network and chose the conservative option. Within roughly an hour of the ransom note being found, Colonial shut down all 5,500 miles.
It is easy, five years on, to call that an overreaction. It was not. It was the only defensible call available to a man who could not prove the contamination stopped at the office door, and whose product is flammable liquid moving under pressure through states. The correct criticism of Colonial is not aimed at May 7. It is aimed at every ordinary day before May 7, when deleting a dead account and bolting a second lock onto an old door would have cost an afternoon.
The shutdown lasted days. Operations restarted on May 12, and full normal service took a little longer. In pipeline terms, that is a short outage. In public terms, it was an eternity, because the public does not experience a pipeline outage as a logistics problem. The public experiences it as a rumor with a deadline: get gas now, before the other guy does.
So the other guy did. And his neighbor. Everyone topped off tanks that were already three quarters full. People who had never owned a gas can bought three. A meaningful share of the Southeast's drivers tried to store, in one weekend, the fuel they would ordinarily have bought gradually over the following two weeks, and no distribution system on earth is sized for its customers all arriving at once with containers. Thousands of stations pumped dry, not because the region ran out of fuel, but because demand got compressed into a spike and dragged forward in time. The actual supply shock was modest and temporary. The behavioral shock was neither. The outage caused the headlines; the headlines caused the shortage.
If you run anything that other people depend on, tape that sequence to the wall. The technical incident and the public incident are two different incidents, and the second one bills you for damages the first one never did.
The ransom, and the un-robbing
Blount authorized the ransom payment the same day the ransomware was found, May 7. Colonial paid 75 bitcoin, about $4.4 million at the time, to the DarkSide affiliate. He later told the Wall Street Journal it was one of the most uncomfortable decisions of his tenure, made because the company did not know how badly it was breached or how long restoration would take, and getting the pipeline's business systems back mattered more than pride. The attackers provided a decryption tool. The tool was so slow that Colonial leaned heavily on its own backups anyway, which is a detail worth savoring: even after paying full price, the product barely worked. Extortionists, it turns out, also ship disappointing software.
DarkSide itself did not enjoy the aftermath. The operation was a ransomware-as-a-service business, a franchising model for crime, in which core developers lease their malware to affiliates for a cut. They had made the classic franchise error of robbing someone so important that the full attention of the United States government landed on them personally. Within about a week, DarkSide announced it was shutting down, claiming it had lost access to its servers. Blount got his Senate hearing. The TSA got new emergency authority over pipeline cybersecurity within the month.
And then, on June 7, exactly one month after the attack, the Department of Justice held a press conference and performed the only recorded instance of a heist movie running in reverse.
The FBI had followed the money. Bitcoin has a property that criminals consistently underrate and investigators consistently appreciate: every transaction is written on a public ledger, forever, where anyone can watch it move. Colonial had notified the FBI quickly, and agents traced the ransom through a series of transfers on that ledger until they could identify a specific address holding approximately 63.7 of the 75 bitcoin. Then the government went to court in the Northern District of California and got a seizure warrant. The affidavit supporting it contains one of the great deadpan sentences in the history of federal paperwork. The bitcoin, it said, had been transferred to a specific address "for which the FBI has the 'private key.'"
A private key is the password to a bitcoin wallet. Whoever has it owns the money, full stop, no appeals desk. The FBI had it. The DOJ did not explain how, at the press conference or in the filing, and it has never really explained since. The coins were duly seized and moved: 63.7 bitcoin recovered out of 75 paid. In dollar terms it was about $2.3 million back of the $4.4 million sent, because bitcoin's price had fallen in the intervening month, which makes this also the only police recovery in history where the evidence depreciated on the way to the station.
Sit with the shape of it, because it is genuinely funny. A criminal syndicate executed one of the most consequential cyberattacks in American history, got paid in untraceable magic internet money, except the money was the opposite of untraceable, and within a month federal agents had un-paid most of it using a password they declined to discuss. The sequel to the robbery was the police robbing the robbers back, legally, with a warrant, and then holding a press conference about it. Deputy Attorney General Lisa Monaco used the occasion to address ransomware crews directly, in essence: we will follow the money, and we can take it. The remaining 11.3 bitcoin, understood to be DarkSide's own commission cut, stayed gone. Eighty-five percent recovered is still the best sequel ratio in the genre.
None of this should be read as "paying ransoms works out fine." It worked out partially, once, because the victim called the FBI fast and the currency happened to be a technology that keeps receipts in public. The FBI's official position remains that you should not pay, and the normal outcome of paying is the money vanishing permanently while the decryptor underperforms. Colonial got the extraordinary ending. The ordinary ending is the reason the extraordinary one made the news.
The lesson
Strip the story down and there are three failures, in ascending order of how badly organizations misunderstand them.
The first is the missing second factor. Multifactor authentication is not exotic. It is a solved, boring, widely available control, and Colonial's main remote access used token based authentication as a matter of course. The legacy profile simply had been grandfathered out of the upgrade. Almost every major breach has a sentence like that buried in it: the control existed, the policy existed, and one corner of the estate, usually the oldest corner, was exempt for reasons nobody could reconstruct afterward. Attackers do not attack your posture. They attack your exceptions.
The second failure is the account that should not have existed. Deprovisioning, the unglamorous discipline of disabling accounts, profiles, and access paths when their purpose ends, is treated in most organizations as housekeeping, the tidying you do when there is time. There is never time, so it does not get done, and the unused access accumulates quietly: former employees' logins, test profiles, legacy integrations, vendor accounts from contracts that ended two reorganizations ago. Every one of them is a door with your company's name on it. Colonial's intruders did not defeat a security program. They walked through the part of the estate the security program had forgotten it owned. Deleting an unused account is not tidiness. It is the same category of act as locking a door, and it deserves the same non-negotiable status.
The third failure belongs to the rest of us. The pipeline outage was a five day logistics problem. The gas lines were a public behavior problem, and they were worse. Any system that serves the public has two surfaces: the technical surface, which fails in ways engineers can model, and the narrative surface, which fails in ways that involve plastic bags. Colonial's attackers reached the first surface. The damage multiplier lived on the second one. Planning for an incident that does not include planning for what the public will do with the news of the incident is planning for the smaller half of the event.
Our own studio keeps a rule for work like this, phrased as an insult because insults are memorable: activity is not output, and a claim is not a fact. The factory version of Colonial's mistake is a worker announcing that something ran when nothing verifiable landed, which is why every result here has to exist as a checkable artifact before it counts. The security version is identical in structure. An inventory that says an account is retired is a claim. The account no longer authenticating is the artifact. Colonial had the claim. The internet had the artifact, and the artifact said the door still opened.
There is a version of May 2021 where none of this happens, and it is a crushingly dull version. Sometime in, say, 2019, an administrator doing lifecycle cleanup disables a VPN profile nobody uses anymore. Or a configuration audit flags the one remote access path still running single factor, and someone bolts on the second lock. Either act takes an afternoon, produces no headline, gets no one promoted, and erases a Senate hearing, a national emergency, a ransom, an FBI seizure, and several thousand plastic bags of gasoline from the timeline. Security work is mostly the manufacture of dull timelines. The Colonial Pipeline attack is what the invoice looks like when the dull work gets deferred: one leaked password, one missing second factor, one account that had outlived its purpose, converted in a single morning into 5,500 idle miles of pipe.
Sources, for the record: Joseph Blount's written and oral testimony before the Senate Committee on Homeland Security and Governmental Affairs, June 8, 2021 (the legacy VPN, the single-factor admission, the complicated password, and the shutdown decision). The Wall Street Journal's interview with Blount, May 19, 2021 (the 75 bitcoin, $4.4 million payment and his reasoning). The Department of Justice press release of June 7, 2021, and the seizure warrant affidavit language quoted in it (the 63.7 bitcoin recovery, the $2.3 million seizure value, and the private key). The FBI's May 10, 2021 statement confirming DarkSide's responsibility. Bloomberg's June 2021 reporting on the Mandiant investigation (the password's presence in a leaked credential batch, and the roughly 100 gigabytes exfiltrated). Colonial Pipeline's published system figures (5,500 miles, about 45 percent of East Coast fuel consumption).
The strongest lock on your newest door is a decoration if the oldest door in the building still opens with a password the whole internet already knows.