Colonial Pipeline ransomware via legacy VPN account
DarkSide affiliates logged into Colonial Pipeline's network through a legacy VPN profile that the company believed was no longer in use, using a valid password. The ransomware attack that followed led Colonial to shut down its fuel pipeline in May 2021. CEO Joseph Blount told the Senate on June 8, 2021 that the legacy VPN had only single-factor authentication; how the password was obtained was not determined.
- Victim
- Colonial Pipeline Company
- Industry
- Energy and utilities
- Country
- United States
- Intrusion began
- Apr 2021
- First disclosed
- May 8, 2021
- Actor
- DarkSide (Extortion group)
- Initial access
- Stolen credentials
- Identity control that failed
- Identity lifecycle
- MFA
- Not enforced on the abused account
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- $4.4 million (Ransom of about $4.4 million paid in bitcoin, as stated by CEO Joseph Blount; the Justice Department later seized about 63.7 BTC (about $2.3 million) of it.)
The identity lesson
An inventory of every remote access account, with dormant profiles disabled and MFA enforced on all VPN logins, would have closed the door DarkSide walked through.
Go deeper on SWI
- Technique: Orphaned account abuse
Sources
- Hackers Only Needed a Single Password to Disrupt Colonial Pipeline, CEO Testifies, Insurance Journal (Bloomberg), Jun 9, 2021
- Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside, U.S. Department of Justice, Jun 7, 2021
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Data Cymru ransomware through a 12-year-old test account with the password Password1 2024 · Stolen credentials
- Actor signs in to Entra ID as applications with stolen client secrets 2026 · Stolen credentials
- Binance wallet theft through compromised engineers and a standing deployment token 2026 · Stolen credentials
- Gheist campaign turns stolen GitHub tokens into Actions secret dumps 2026 · Stolen credentials
Cite this record
SWI Community Team. (2026). Colonial Pipeline ransomware via legacy VPN account. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2021-colonial-pipeline-legacy-vpn/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.