Back to the archive
Incident file · 2021
Colonial Pipeline
Energy · United States · Threat actor: DarkSide
Ransomware
Ransom paid
- US$4.4m
- Ransom demanded
- US$4.4m
- Ransom paid
- 6 days
- Estimated downtime
- US$200m
- Est. revenue lost
What happened
A single legacy VPN account without MFA let DarkSide deploy ransomware, shutting the largest US fuel pipeline.
How it ended
Paid 75 BTC; the US DOJ later clawed back approximately US$2.3m of the payment.
Data affected
Operational systems only
Sources and further reading
Would your business survive this incident?
We stress-test detection, response and recovery so a ransom demand is never your only option.