Colonial Pipeline: Stolen VPN Password With No MFA Shut Down Fuel Supply

DarkSide ransomware operators logged into Colonial Pipeline’s network using credentials from an unused VPN account whose password had been reused and never protected by any second factor. That single login gave them the session needed to explore the environment, exfiltrate data, and deploy ransomware that shut down the 5,500-mile pipeline carrying 45 percent of East Coast fuel supplies for six days. The company later paid a $4.4 million ransom to regain access.

The Unused VPN Account With Only a Password

The initial access vector was straightforward. Attackers obtained a password that belonged to a Colonial Pipeline employee account no longer in active use. Because the VPN required nothing beyond that password, the stolen credential worked on the first attempt. According to Verizon’s 2022 DBIR, stolen credentials ranked among the top five actions observed in confirmed breaches that year, and 82 percent of breaches involved the human element including credential theft.

Once inside the VPN, the attackers received an authenticated session on the corporate network. No additional proof of identity was demanded at that boundary. The account had been left active with no multi-factor requirement, a common configuration at the time for remote-access systems that were assumed to sit behind other controls.

What Happened After the VPN Session Was Granted

With an active VPN session in hand, the operators did not need to authenticate again to reach internal systems. They moved laterally, located backup and domain-controller infrastructure, and staged ransomware. Data was also exfiltrated before encryption began. The ransomware deployment and the operational shutdown that followed were direct consequences of the initial authenticated session; nothing in the authentication layer challenged the activity once the VPN tunnel existed.

CISA’s post-incident reporting confirmed that the compromised account lacked multi-factor authentication. The absence meant the entire attack chain after the password worked required no further interaction with any identity system. Colonial Pipeline paid the ransom on 7 May 2021 and restored operations days later.

One Credential Controlled Access to Critical Operations

The blast radius traced directly to the VPN login. Because the VPN account carried broad network access and no second factor was present, one compromised password translated into control over systems that could halt fuel distribution across the eastern United States. Verizon’s 2022 report noted that credentials remained the most commonly compromised data type in system-intrusion breaches, appearing in 42 percent of those cases.

The same pattern appears in other incidents where remote-access passwords were the sole gate: once the session is issued, subsequent actions inherit that trust. Colonial Pipeline’s case shows the operational result when that trust is placed in a single reusable factor.

The technical reasons password-based authentication leaves exactly this gap open, and what replaces it, are covered at mfa2point0.com.

FAQ

How did DarkSide obtain the Colonial Pipeline VPN password?

Public reporting indicates the password had been reused and was available on the dark web from a prior incident; the account itself was dormant and required only that password to reach the corporate network.

Would any form of MFA on the VPN have stopped the Colonial Pipeline breach?

A device-bound credential checked at VPN login would have required the attacker to also possess the enrolled hardware and its private key which is impossible without physical access to the device. That simple change would have prevented this attack.

Why did the attackers not need additional logins after the VPN connection?

The VPN session itself granted authenticated access to internal resources. Once established, later actions such as lateral movement and ransomware deployment occurred inside that trusted session.

What role did password reuse play in the Colonial Pipeline incident?

The password matched an account that had been left enabled. Reuse across sites allowed the credential to remain valid long after the employee stopped using it, removing any need for the attackers to obtain fresh credentials.

Did Colonial Pipeline use single sign-on or federation that expanded the damage?

The documented entry point was direct VPN access rather than a federated token. The lack of MFA at that VPN boundary was sufficient to give the operators the network position they needed.