On May 7, 2021, DarkSide ransomware disrupted computerized systems at Colonial Pipeline, which carries gasoline, diesel, and jet fuel from Texas to the U.S. East Coast—about 45% of the region’s fuel supply. Investigators reported that attackers entered through a compromised password for an inactive virtual private network account lacking multifactor authentication. Although pumping equipment reportedly remained operational, Colonial halted the entire pipeline after attackers targeted billing infrastructure and stole nearly 100 gigabytes of data, threatening to publish it. CEO Joseph Blount approved a ransom of 75 bitcoin, then worth about $4.4 million, within hours of the attack.
The six-day shutdown triggered fuel shortages, panic buying, emergency transportation measures, and sharply higher prices; by May 14, 87% of Washington, D.C., filling stations reportedly lacked fuel. Operations restarted May 12 and returned to normal by May 15. On June 7, 2021, the Justice Department announced that the FBI had recovered 63.7 bitcoins using the ransom wallet’s private key, though the cryptocurrency’s price decline reduced their value to roughly $2.3 million. President Joe Biden’s Executive Order 14028 followed on May 12, strengthening federal software-security and incident-reporting standards. The episode also exposed failures in government information sharing: a Senate hearing found that the Department of Homeland Security had not been alerted and that the Justice Department lacked details about the ransom.
