Colonial Pipeline: How Hackers ​​​​​​​Exploited A Password Policy Problem

A single password on an old, unprotected account – that's all it took for hackers to paralyze the largest fuel pipeline in the United States.

The account was no longer in use at the time of the attack, but the compromised password still worked – and with no other security measures in place, Colonial Pipeline was defenseless against the hackers that accessed its systems on May 7, 2021. Two days later, the federal government declared a state of emergency in 17 states and Washington, D.C., due to spiking gasoline prices, panic buying and thousands of empty gas stations on the East Coast, after Colonial shut down its pipeline operations to contain the cyberattack. After a six-day shutdown and a $4.4 million ransom paid to the attackers, Colonial's systems went back online. However, as high-profile cyberattacks and ransom payments provide incentives to other would-be hackers, similar ransomware attacks are likely to become even more frequent in the future.