Colonial Pipeline ransomware via legacy VPN account
DarkSide affiliates logged into Colonial Pipeline's network through a legacy VPN profile that the company believed was no longer in use, using a valid password. The ransomware attack that followed led Colonial to shut down its fuel pipeline in May 2021. CEO Joseph Blount told the Senate on June 8, 2021 that the legacy VPN had only single-factor authentication; how the password was obtained was not determined.
- Victim
- Colonial Pipeline Company
- Industry
- Energy and utilities
- Country
- United States
- Intrusion began
- Apr 2021
- First disclosed
- May 8, 2021
- Actor
- DarkSide (Extortion group)
- Initial access
- Stolen credentials
- Identity control that failed
- Identity lifecycle
- MFA
- Not enforced on the abused account
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- $4.4 million (Ransom of about $4.4 million paid in bitcoin, as stated by CEO Joseph Blount; the Justice Department later seized about 63.7 BTC (about $2.3 million) of it.)
The identity lesson
An inventory of every remote access account, with dormant profiles disabled and MFA enforced on all VPN logins, would have closed the door DarkSide walked through.
Go deeper on SWI
- Technique: Orphaned account abuse
Sources
- Hackers Only Needed a Single Password to Disrupt Colonial Pipeline, CEO Testifies, Insurance Journal (Bloomberg), Jun 9, 2021
- Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside, U.S. Department of Justice, Jun 7, 2021
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- GhostAction returns: hijacked GitHub accounts push secret-stealing workflows 2026 · Stolen credentials
- CrowdSec private repositories copied with a departing engineer's GitHub token 2026 · OAuth token abuse
- Nikkei Slack workspace accessed with credentials stolen by malware 2025 · Stolen credentials
- PowerSchool SIS data theft through a compromised support-portal credential 2025 · Stolen credentials
Cite this record
SWI Community Team. (2026). Colonial Pipeline ransomware via legacy VPN account. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2021-colonial-pipeline-legacy-vpn/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.