INCIDENT REPORT · CP-2021-002
Colonial Pipeline ransomware attack
L4 · CRITICALCONFIRMED
A ransomware attack on 7 May 2021 led Colonial Pipeline to halt operations of its fuel pipeline. Fuel shortages followed in parts of the US.
- Incident ID
- CP-2021-002
- Incident date
- 07 MAY 2021
- Detection date
- 07 MAY 2021
- Affected countries
- United States
- Plotted location
- Alpharetta, United States (Affected organization headquarters)
- Threat classification
- Level 4 — CRITICAL
- Classification rationale
- Shutdown of a major fuel pipeline with regional fuel shortages — significant disruption to essential services.
- Attack type
- Ransomware
- Nature
- Malicious activity
- Attack vector
- Compromised password for a legacy VPN account that used only single-factor authentication (per CEO Senate testimony)
- Sectors
- Energy
- Critical infrastructure
- Yes
- Organizations affected
- Colonial Pipeline Company
- Operational consequences
- The pipeline was halted and fuel shortages followed. Colonial paid a ransom of 75 bitcoin (about $4.4m at the time); the DOJ later seized about 63.7 bitcoin (about $2.3m).
- Estimated financial impact
- Ransom of ~$4.4m (75 BTC) stated by CEO Joseph Blount in Senate testimony; total incident cost not disclosed.
- Attribution (as stated)
- Attributed by the FBI and US Department of Justice to the DarkSide ransomware group
SOURCE REFERENCES
- [1] Colonial CEO: Legacy VPN with no MFA was used in ransomware attackCybersecurity Dive · cybersecuritydive.com · 08 JUN 2021
- [2] DOJ seizes $2.3 million in cryptocurrency paid to DarkSide by Colonial PipelineCyberScoop · cyberscoop.com · 07 JUN 2021
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.