Colonial Pipeline: Responding to a Ransomware Attack in the Energy Sector

ABSTRACT Surveys suggest that almost half of recent cyberattacks have involved ransomware. This case concerns the May 2021 cyberattack on Colonial Pipeline, a private company within the U.S. critical energy infrastructure, and reveals a web of vulnerabilities in the company’s cybersecurity controls. Prompted by a ransom note demanding 75 bitcoins ($4.4 million), Colonial Pipeline shut down its pipelines and called in a cybersecurity consultant to investigate. The attackers, identified as the DarkSide group, exploited a reused password leaked in a prior data breach and gained access to an inactive employee account on a virtual private network lacking two-factor authentication. This ransomware incident underscores the imperative for implementing robust cybersecurity measures, including enhanced user authorization management and multifactor authentication (MFA), in an ever-evolving cyber threat landscape. This case critically examines the Colonial Pipeline cyberattack and offers insights into how to mitigate cyber threats and respond to ransomware demands for organizations worldwide.