Pipeline

Colonial Pipeline — DarkSide ransomware shutdown

7–12 May 2021

United States (Houston, Texas to Linden, New Jersey system)

What happened

DarkSide ransomware compromised Colonial Pipeline's IT network, and the company proactively shut down its entire 5,500-mile refined-products system — which carries over 100 million gallons a day, nearly half the US East Coast's fuel — for about five days as a containment precaution. The shutdown triggered fuel shortages, panic buying, price spikes and emergency declarations across the southeastern US. Colonial paid a ransom of roughly $4.4 million, part of which the Department of Justice later recovered. The operational technology systems were not confirmed to be directly compromised; the disruption came from the precautionary shutdown. The marker is placed at Colonial's Alpharetta, Georgia headquarters.

Evidence
Documented
Confidence
High
Infrastructure
Pipeline
Latitude
34.0580°
Longitude
-84.2730°

Attribution

Attributed to DarkSide ransomware group

The FBI confirmed DarkSide ransomware was responsible. The US later recovered a portion of the roughly $4.4 million ransom paid.

Sources

  1. Colonial Pipeline Cyber IncidentUS Department of Energy · Incident reporting