Volume 2Oil and Gas edition2021Last verified 13 sources, 11 primaryDarkSide ransomware, per the FBI
In May 2021 a ransom note on Colonial's business network led its own crew to stop 5,500 miles of fuel pipeline in about fifteen minutes. The pipeline controls were never shown to be touched. Restarting was the hard part.
Nothing in the record shows the attacker reached the systems that move fuel. What stopped the pipeline was a person: an employee found a ransom note on an IT system, a control center supervisor issued a stop work order, and in about fifteen minutes 5,500 miles were down. With an intruder of unknown reach and no way yet to prove the operational side clean, stopping was the right decision, and the crew did its job.
The argument is about the week that followed. The CEO testified that the first week went to restoring IT systems needed for a safe restart, and the pipeline regulator alleged Colonial was not prepared for a manual restart; Colonial settled without admitting it. The attacker needed one password on a profile nobody meant to use. The duration came from how much of the physical operation depended on the business network to start again. That is BlastWave's analysis, not a disclosed fact.
What is not known: How the attacker obtained the password is undetermined; Mandiant told Congress reuse from another compromised site was a possibility. The dark web detail comes from press, not testimony. Billing as the reason for the shutdown rests on unnamed sources; the sworn reason is containment. No evidence of OT access was confirmed, which is not proof there was none. Colonial is private and has published no incident cost. The affiliate who ran the intrusion, the systems encrypted, and how long a full manual restart would have taken are undisclosed.
Recommendation
Take the path away Retire every remote access path nobody means to use, and keep the systems that start, schedule and meter the pipeline off the network a ransom note can land on.
Remove credential-based access No remote session on a password alone. Bind access to a verified identity and device, with multifactor authentication as the floor rather than the goal.
Read one way, then run without it Billing and scheduling take their numbers over a one-way path, so operations never need the business network to restart, and manual restart is exercised on a calendar.
Sources: Blount, Senate HSGAC testimony, 8 Jun 2021; House Homeland Security hearing, 9 Jun 2021; FBI statement, 10 May 2021; CISA/FBI AA21-131A, 11 May 2021; PHMSA CPF 3-2022-026 (NOPV 5 May 2022; Consent Order 1 Sep 2023). Full list with links.
Soft Spots: OT status is a time-bound absence (“at this time”), not a finding of clean. Billing as the shutdown reason rests on press sources, not testimony. That the duration came from restart dependence on IT is BlastWave's analysis.
The full record
Every claim numbered to its source. Last updated .
A ransom note on the business network, a fifteen-minute shutdown by the operator, and a restart that took days. What is verified, what is only reported, and what is still unknown.
Summary
In May 2021, a ransom note found on Colonial Pipeline's business network led the company's own control center to stop its 5,500-mile fuel pipeline in about fifteen minutes. The FBI attributed the attack to DarkSide ransomware. As of June 2021, Mandiant had confirmed no evidence that the pipeline's control systems were reached. Restart began on 12 May, and the system was fully operational on 17 May.
Timeline of the Colonial Pipeline attack
Every date is tied to a source. Press reporting appears only as evidence of what was said.
An employee finds a ransom note on a system in the IT network. The operations supervisor at the control center puts in a stop work order.1
Shutdown of the entire pipeline system is complete, about fifteen minutes after it began.1,8
Colonial pays the ransom, $4.4 million according to CEO Joseph Blount's testimony; the Justice Department put it at about 75 bitcoin.2,7
The FBI confirms DarkSide ransomware is responsible. The White House describes DarkSide's affiliate model. Line 4 runs under manual control.4,6,8
CISA and the FBI publish advisory AA21-131A on DarkSide.5
Restart begins at about 5 p.m. ET. The same day, CNN reports, citing three people briefed on the matter, that the shutdown was because the billing system was compromised.8,12
TSA issues Security Directives Pipeline-2021-01 (May) and Pipeline-2021-02 (July).11
The Justice Department seizes 63.7 bitcoin, about $2.3 million at that day's price.7
Blount testifies to the Senate Homeland Security Committee; Blount and Mandiant's Charles Carmakal testify to the House Homeland Security Committee.1,2,3
PHMSA issues a Notice of Probable Violation alleging Colonial was not prepared for manual restart, with a proposed $986,400 penalty.9
The case settles by Consent Agreement and Order: $948,400, with no admission. The case closes on 9 April 2024.10
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
No compromise of the pipeline's operational technology was shown. The ransom note was on an IT system. Colonial's CEO told the Senate on 8 June 2021:
"Up to this point, Mandiant has not confirmed any evidence that they were in the OT system, and typically that is not what DarkSide does."
CISA and the FBI said on 11 May 2021 that "at this time, there is no indication that the entity's operational technology (OT) networks have been directly affected by the ransomware."5 Both statements carry a time qualifier. The accurate summary is that OT access was never shown, which is not the same as proof there was none.
Why did Colonial shut down the pipeline?
The sworn reason is containment. In written testimony, Blount said the shutdown was to help ensure the malware did not spread to the OT network that controls pipeline operations, if it had not already.1 The stop came from a person, not the attacker: the control center supervisor issued a stop work order and the line was down in about fifteen minutes.
The account that Colonial stopped because its billing system was compromised comes from CNN, citing three people briefed on the matter, on 12 May 2021.12 It does not appear in the sworn record. It may bear on why the restart took days; it is not the reason the line was stopped.
"Our focus that first week was to restore the critical systems that we needed on the IT side in order to safely and securely bring our pipeline system back up."
Blount also testified that a systemwide manual restart was discussed and judged slower than repairing the critical IT systems.2
How did the attackers get into Colonial Pipeline?
By the CEO's account, through a legacy VPN profile that accepted a password alone. Blount testified the profile was "not intended to be in use" and stated it as a belief during an ongoing investigation.1,2 How the attacker obtained the password was never established. Under oath, Mandiant's chief technology officer said:
"We did not figure out exactly how the attacker was able to get access to the username, but it is a possibility that the attacker was able to leverage credentials that the employee may have used on another website that was compromised."
The detail that the password was found on the dark web comes from Carmakal speaking to Bloomberg on 4 June 2021, in an article that also records he was not certain that is how it was obtained.13 It is press, not testimony.
The ransom and the cost
The cost of the incident is undisclosed. The $4.4 million is the ransom, about 75 bitcoin, paid on 8 May 2021.2,7 The Justice Department seized 63.7 of those bitcoin on 7 June 2021, worth about $2.3 million that day; the lower figure reflects the bitcoin price, not a recovery of half the ransom.7 Colonial is privately held and has published no incident cost.
What is still not known about Colonial Pipeline
How the attacker obtained the VPN password.
Which DarkSide affiliate ran the intrusion.
Which systems were encrypted. Blount testified to "corruption of the critical IT systems" and to seven finance systems still offline in June, but no list exists.2
Whether any OT system was reached. No evidence of OT access was confirmed, which is not proof there was none.
The incident's total cost.
How long a full manual restart would have taken.
Claims about Colonial Pipeline the record does not support
Widely repeated claim
What the record says
"Colonial shut down because billing was hacked."
Unnamed sources to CNN. The sworn reason is containment.1,12
"The password was found on the dark web, and that is how they got in."
Press, not testimony. Under oath: "a possibility"; Mandiant "did not figure out exactly how."3,13
"The attack cost $4.4 million."
$4.4 million is the ransom. The cost is undisclosed.2
Including our own. The Volume 1 Hackopedia entry listed the $4.4 million ransom as the "Estimated Cost" and stated as settled that the password was "acquired in a separate data breach." Both are corrected here. We correct our own record first; it is what earns the right to correct anyone else's.
Regulatory aftermath
TSA security directives. TSA issued Security Directive Pipeline-2021-01 in May 2021 and Pipeline-2021-02 in July 2021, setting cybersecurity requirements for critical pipeline owners and operators.11
PHMSA enforcement. On 5 May 2022, PHMSA alleged that an untested plan for manual operation left Colonial "not prepared for manual restart" and proposed a $986,400 penalty.9 The case settled in 2023: Colonial "neither admits nor denies the allegation" but accepted the finding of violation for settlement purposes and paid $948,400. In the same document PHMSA states it "is not alleging that Respondent did anything to cause the May 7, 2021, criminal cyberattack."10 Colonial's own response to the notice, filed 6 June 2022, disputes the restart-delay implication: "To be clear, any suggestion in the NOPV and PCO that an alleged lack of a communication plan for manual operations caused a delay in the restart of our system is not factual." That is the operator's position, not a finding.10
BlastWave analysis: the stop was right, the restart was the problem
Analysis, not a disclosed fact
With an intruder of unknown reach on the business network and no way yet to prove the operational side clean, stopping was the safe move, and the crew that did it in fifteen minutes did its job. The architecture question is about the week that followed. The attacker needed one password on one remote access profile nobody meant to use. The duration came from how much of the physical operation depended on the business network to start again. That is BlastWave's analysis, not a disclosed fact.
Podcast: “The Ticket Printer” (8:59). Joe Baxter and Cam Cullen on why the stop was right and the restart was the problem.
Video: Colonial Pipeline Short (60 to 90 seconds).
Frequently asked questions
What happened in the Colonial Pipeline attack?
Just before 5:00 a.m. EDT on 7 May 2021, a Colonial Pipeline employee found a ransom note on a system in the company's IT network. A control center supervisor issued a stop work order, and the 5,500-mile fuel pipeline was shut down in about fifteen minutes. The FBI identified DarkSide ransomware. Restart began on 12 May and Colonial reported the system fully operational on 17 May.
Were Colonial Pipeline's control systems (OT) hacked?
No compromise of the operational technology was shown. Colonial's CEO testified on 8 June 2021 that "up to this point, Mandiant has not confirmed any evidence that they were in the OT system." CISA and the FBI said on 11 May 2021 that "at this time, there is no indication" the OT networks were directly affected. Both statements are time-bound: absence of confirmed evidence is not proof of absence.
Why did Colonial Pipeline shut down the pipeline?
The sworn reason is containment: to help ensure the malware did not spread to the OT network that controls the pipeline, if it had not already. The widely repeated account that the billing system forced the shutdown comes from unnamed sources quoted by CNN on 12 May 2021, not from testimony.
How did the attackers get into Colonial Pipeline?
Colonial's CEO testified that he believed the attackers used a legacy VPN profile that was not intended to be in use and accepted a password alone, without multifactor authentication. How the password was obtained was never established. Mandiant's Charles Carmakal testified that reuse from another compromised website was "a possibility" and that Mandiant "did not figure out exactly how."
Who was behind the Colonial Pipeline attack?
The FBI confirmed on 10 May 2021 that DarkSide ransomware was responsible. DarkSide operated as ransomware-as-a-service, in which affiliates carry out intrusions and share proceeds with the developers. The affiliate who ran this intrusion has not been publicly identified, and no state attribution appears in any federal statement cited here.
How much did the Colonial Pipeline attack cost?
The incident cost is undisclosed. Colonial is privately held and has published no figure. The $4.4 million (about 75 bitcoin) is the ransom, not the cost. The Justice Department seized 63.7 bitcoin on 7 June 2021, worth about $2.3 million that day; the lower dollar value reflects the bitcoin price, not a partial recovery of half the ransom.
What regulation followed the Colonial Pipeline attack?
TSA issued Security Directive Pipeline-2021-01 in May 2021 and Pipeline-2021-02 in July 2021. In May 2022 PHMSA proposed a civil penalty alleging Colonial was not prepared for manual restart; the case settled in 2023 for $948,400 with no admission, and PHMSA stated it was not alleging Colonial did anything to cause the cyberattack.
Primary sources are sworn testimony, federal documents, regulator records and the company's own dated statements. Press is cited only as evidence of what was said.
Sworn testimonyJoseph A. Blount, Jr., written testimony, Senate Committee on Homeland Security and Governmental Affairs, "Threats to Critical Infrastructure: Examining the Colonial Pipeline Cyber Attack," 8 June 2021. PDF
Sworn testimonyHearing transcript, S. Hrg. 117, same hearing, 8 June 2021 (exchanges with Chairman Peters, Ranking Member Portman, Sen. Lankford, Sen. Hawley). govinfo.gov
Sworn testimonyHouse Committee on Homeland Security, "Cyber Threats in the Pipeline: Using Lessons from the Colonial Ransomware Attack to Defend Critical Infrastructure," 9 June 2021: testimony of Joseph Blount and Charles Carmakal. govinfo.gov
FederalFBI, "FBI Statement on Compromise of Colonial Pipeline Networks," 10 May 2021. fbi.gov
FederalCISA and FBI, Joint Cybersecurity Advisory AA21-131A, "DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks," 11 May 2021. cisa.gov
FederalWhite House press briefing with Dr. Elizabeth Sherwood-Randall and Anne Neuberger, 10 May 2021. archives
FederalUS Department of Justice, "Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside," 7 June 2021. justice.gov
CompanyColonial Pipeline Company, media statement updates, 8 to 17 May 2021 (colpipe.com).
RegulatorPHMSA, "PHMSA Issues Proposed Civil Penalty of Nearly $1 Million to Colonial Pipeline Company for Control Room Management Failures," 5 May 2022, and Notice of Probable Violation CPF 3-2022-026. phmsa.dot.gov · Notice (PDF)
RegulatorPHMSA, Consent Agreement and Consent Order, CPF 3-2022-026, executed 30 August 2023, issued 1 September 2023; enforcement record closed 9 April 2024. The same case record carries Colonial's response to the Notice of Probable Violation, 6 June 2022. Case record
FederalTSA, "DHS announces new cybersecurity requirements for critical pipeline owners and operators," 20 July 2021. tsa.gov
PressCNN, "Colonial Pipeline did pay ransom to hackers, sources now say," 12 May 2021. Cited as evidence of what was said. cnn.com
PressBloomberg, "Hackers Breached Colonial Pipeline Using Compromised Password," 4 June 2021. Cited as evidence of what was said.
Cite this page
BlastWave. “Colonial Pipeline Ransomware Attack (2021): What Is Verified.” Hackopedia, Volume 2, FILE 001. Last verified 15 October 2026. https://hackopedia.blastwave.com/oil-and-gas/colonial-pipeline-2021/
Revision history
Date
Change
15 Oct 2026
Re-verified against primary sources. Added Colonial's 6 June 2022 response to PHMSA, which disputes that the alleged plan gap delayed the restart, as the operator's position. Confirmed the ransom payment date in the Justice Department's seizure release. No facts changed.
6 Oct 2026
Numbered FILE 001 in Hackopedia Volume 2, in the Oil and Gas edition.
28 Sep 2026
Hand-check against the primary record: the Senate and House transcripts, Blount's written testimony, CNN's 12 May 2021 report and our Volume 1 page were read at source to confirm the quotations this page carries.
26 Sep 2026
Full validation. The ransom's bitcoin count is now attributed to the Justice Department rather than to Colonial's CEO, and PHMSA's public framing of its allegation is carried as an allegation settled without admission.
24 Sep 2026
Volume 2 entry built from primary sources. Corrected two Volume 1 errors: the ransom shown as the incident cost, and the password's origin stated as settled.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
