CASE-03 · Case Study — Colonial Pipeline: One Password

What happened

In May 2021, Colonial Pipeline — the operator of the largest refined-fuel pipeline on the U.S. East Coast — was hit by ransomware from affiliates of the DarkSide group. The intruders did not exploit an exotic zero-day or a chain of clever tricks. They logged in. They used a single leaked password that belonged to a legacy virtual private network account. That account was no longer in active use, but it still worked, and it had no second factor guarding it. With that one credential, an attacker reached the company's network the same way an employee would — through the front door, with a valid login. Once ransomware was loose on the IT side, Colonial made the decision to proactively shut down the pipeline itself to contain the damage, and the fuel stopped flowing.

See it — root cause to the control that stops it

flowchart TD
  A["Leaked V.P.N. password"] --> B["Legacy account<br/>still active"]
  B --> C["No M.F.A. on<br/>remote access"]
  C --> D["Attacker logs in<br/>as a valid user"]
  D --> E["Ransomware,<br/>pipeline shutdown"]
  F["M.F.A. on all<br/>remote access"] -. blocks .-> C
  G["Retire unused<br/>accounts"] -. blocks .-> B

The root cause

The root cause was not the leaked password by itself — passwords leak all the time. The root cause was that a single leaked password was enough. The compromised account was a remote-access V.P.N. login with two compounding weaknesses. First, it had no multi-factor authentication, so knowing the password was the entire test; there was no second proof of identity to stop a stranger who held it. Second, the account was no longer in active use, yet it had never been deprovisioned, so it remained a live, valid path into the network. An old credential that should have been dead was still alive, and it was protected by a single secret that had already escaped. That combination — an active credential, no second factor, no cleanup — turned a routine password leak into a full network intrusion.

The control that would have stopped it

Two ordinary controls, either one of which would have broken the chain. First, multi-factor authentication on all remote access. With M.F.A. required, the leaked password alone is not enough; the attacker would also need the second factor, which they did not have, and the login fails. Second, deprovisioning of unused accounts. If the legacy V.P.N. account had been retired when it fell out of use, there would have been no valid credential for the leaked password to unlock — the door would not exist. Neither of these is advanced or expensive. They are hygiene: prove identity with more than a secret, and delete access you no longer use. The lesson of Colonial Pipeline is that the boring controls were the ones that mattered.

The blast radius

The impact reached far past one company's network. To contain the ransomware, Colonial proactively shut down the pipeline, and that shutdown halted a pipeline that carries roughly 45 percent of the fuel supply for the U.S. East Coast, for days. The disruption rippled into gas stations, panic buying, and emergency declarations across affected regions. Colonial paid a ransom of about 4.4 million dollars to the attackers, a sum that the U.S. Department of Justice was later able to partially recover. The event became one of the most visible critical-infrastructure cyber incidents in U.S. history, and it prompted new federal attention to pipeline cybersecurity. All of it traced back to one account and one missing second factor.

See it

The failure is a straight line: a leaked password meets a legacy account that was never retired, which has no multi-factor authentication, so an attacker simply logs in as a valid user — and the end of that line is ransomware and a pipeline shutdown that stopped nearly half of one coast's fuel. Two controls cut the line before it starts: multi-factor authentication on all remote access neutralizes the leaked password, and retiring unused accounts removes the door entirely.

The lesson

If a single stolen password can reach your network, you do not have an authentication problem — you have a single point of failure.

Where it rhymes

This is a textbook case of OWASP A07, Identification and Authentication Failures — an authentication that relied on one secret with no second factor and no lifecycle management. In MITRE ATT&CK terms it maps to Valid Accounts (T1078): the adversary used legitimate credentials for initial access, which is exactly why nothing looked like an attack. The same shape recurs anywhere a long-lived credential outlives its purpose and stands alone — orphaned service accounts, forgotten admin logins, and any remote-access path where the password is the only gate.

Named concepts: identification and authentication failures, multi-factor authentication, account deprovisioning, remote access security