On May 7, 2021, ransomware linked by the FBI and media reports to the DarkSide criminal group forced Colonial Pipeline to halt its entire network, which transports gasoline, diesel, and jet fuel from Texas to the U.S. East Coast. The attackers reportedly entered through a compromised password for an inactive virtual private network account that lacked multifactor authentication. Although the attack primarily affected billing systems and the pumping infrastructure remained operational, Colonial shut down the pipeline as a precaution. The company also reported that nearly 100 gigabytes of data had been stolen and used as leverage.
Chief executive Joseph Blount authorized payment of approximately 75 bitcoin, then valued at $4.4 million, within hours of the intrusion. The decryption tool supplied by DarkSide was reportedly slow, and Colonial’s continuity measures were more effective in restoring service. Operations restarted on May 12 after a six-day shutdown, but shortages, panic buying, and price increases affected several southeastern states; 87% of Washington, D.C., stations reportedly lacked fuel by May 14. On June 7, 2021, the Justice Department said the FBI recovered 63.7 bitcoin using the ransom wallet’s private key, worth about $2.3 million after Bitcoin’s price fell. The incident prompted President Joe Biden’s Executive Order 14028, a Justice Department ransomware task force, and renewed scrutiny of critical-infrastructure security and government information-sharing failures.
