Episode 238 | Historical Events
In this History episode we focus on the May 2021 Colonial Pipeline ransomware attack — the largest refined petroleum products pipeline in the United States, 5,500 miles from Texas to New Jersey, shut down for five days by a criminal hacking group called DarkSide that gained access through a single compromised password on an inactive VPN account not protected by multi-factor authentication. The five-day shutdown caused fuel shortages across thirteen states, panic buying, and images of Americans filling plastic bags with gasoline.
We trace the specific vulnerability — a reused or leaked password on an unmonitored account, no multi-factor authentication, insufficient network segmentation — alongside the unusual aftermath: Colonial paid $4.4 million in bitcoin within hours of discovering the attack, and the DOJ subsequently recovered 63.7 of the 75 bitcoin paid, demonstrating that cryptocurrency payments are not automatically untraceable when law enforcement is actively monitoring a criminal group. DarkSide announced it was shutting down. The TSA issued new cybersecurity directives for pipeline operators. The Colonial attack became the event that transformed critical infrastructure cybersecurity from a policy document concern into a kitchen table issue.
