ALT-45 · Analysis · 23 Oct 2026
Colonial Pipeline: one password, one pipeline
Ransomware on the business network led the largest US fuel pipeline to shut down for days. Access came through an old VPN account without multi-factor authentication. Part of the ransom was later recovered.
- 7 May 2021Ransomware found; pipeline operations halted.
- 12 May 2021Restart of operations begins.
- 7 Jun 2021DOJ announces recovery of 63.7 bitcoin of the ransom.
- 8 Jun 2021CEO testifies about the VPN account without multi-factor authentication.
- Ransom paid
- 75 BTCUS Department of Justice
- Recovered by the FBI
- 63.7 BTCUS Department of Justice
IT problem, physical consequence
The ransomware did not reach the systems that control the pipeline. The shutdown came from uncertainty: without trustworthy billing and business systems, and without knowing how far the attack had spread, stopping was the safe choice.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Forgotten accounts are open doors; dormant access must expire.
- When IT and operations depend on each other, an IT incident is an operational one.
- Following the money works sometimes — but recovery is the exception.
What to do
- Require multi-factor authentication on every remote-access path, with no exceptions.
- Review and disable inactive accounts automatically.
- Decide in advance which business systems operations truly depend on.
Sources
- US DOJ — Department of Justice seizes $2.3 million in cryptocurrency paid to DarkSide
- CISA — The attack on Colonial Pipeline: what we've learned
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-45 — Colonial Pipeline: one password, one pipeline. 23 Oct 2026. altumptic.com/research/colonial-pipeline-2021