Pipeline
Colonial Pipeline — DarkSide ransomware shutdown
7–12 May 2021
United States (Houston, Texas to Linden, New Jersey system)
What happened
DarkSide ransomware compromised Colonial Pipeline's IT network, and the company proactively shut down its entire 5,500-mile refined-products system — which carries over 100 million gallons a day, nearly half the US East Coast's fuel — for about five days as a containment precaution. The shutdown triggered fuel shortages, panic buying, price spikes and emergency declarations across the southeastern US. Colonial paid a ransom of roughly $4.4 million, part of which the Department of Justice later recovered. The operational technology systems were not confirmed to be directly compromised; the disruption came from the precautionary shutdown. The marker is placed at Colonial's Alpharetta, Georgia headquarters.
- Evidence
- Documented
- Confidence
- High
- Infrastructure
- Pipeline
- Latitude
- 34.0580°
- Longitude
- -84.2730°
Attribution
Attributed to DarkSide ransomware group
The FBI confirmed DarkSide ransomware was responsible. The US later recovered a portion of the roughly $4.4 million ransom paid.