Cyberattack

Pipeline

Colonial Pipeline — DarkSide ransomware shutdown

7–12 May 2021

United States (Houston, Texas to Linden, New Jersey system)

34.0580, -84.2730

Loading free detailed map…

What happened

DarkSide ransomware compromised Colonial Pipeline's IT network, and the company proactively shut down its entire 5,500-mile refined-products system — which carries over 100 million gallons a day, nearly half the US East Coast's fuel — for about five days as a containment precaution. The shutdown triggered fuel shortages, panic buying, price spikes and emergency declarations across the southeastern US. Colonial paid a ransom of roughly $4.4 million, part of which the Department of Justice later recovered. The operational technology systems were not confirmed to be directly compromised; the disruption came from the precautionary shutdown. The marker is placed at Colonial's Alpharetta, Georgia headquarters.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.

Evidence
Documented
Confidence
High
Infrastructure
Pipeline
Current temperature
Loading…
Latitude
34.0580°
Longitude
-84.2730°

Attribution

Attributed to DarkSide ransomware group

The FBI confirmed DarkSide ransomware was responsible. The US later recovered a portion of the roughly $4.4 million ransom paid.

Sources

  1. Colonial Pipeline Cyber IncidentUS Department of Energy · Incident reporting