Incident: Ransomware Attack on Colonial Pipeline: Shutdown, Ransom Payment, and Recovery.

Published Date: 2019-05-22

Postmortem Analysis
Timeline 1. The software failure incident involving Colonial Pipeline occurred in May 2021 [115613]. 2. The incident in 22 small Texas towns happened more than two weeks ago in May 2019 [88390]. 3. The cyberattack on Baltimore's government systems was discovered on May 7, 2019 [84782]. 4. The cyberattack on Toshiba's European division in France by DarkSide occurred on May 4, 2021 [124472]. 5. The cyberattack on the US fuel pipeline, Colonial Pipeline, took place in May 2021 [114505].
System 1. Colonial Pipeline's computer systems [115613] 2. Legacy Virtual Private Networking (VPN) system without multi-factor authentication [115482]
Responsible Organization 1. DarkSide criminal gang [114505] 2. Hackers [88390] 3. Ransomware attackers [115613]
Impacted Organization 1. Colonial Pipeline [115613] 2. 22 small Texas towns [88390] 3. Baltimore's city government [84782]
Software Causes 1. The ransomware attack on Colonial Pipeline was caused by hackers remotely blocking access to important data until a ransom was paid, leading to the shutdown of the company's IT systems [115613]. 2. The hackers gained access to Colonial Pipeline's computer networks in April by using a compromised password associated with a disused virtual private networking account, which did not have multi-factor authentication enabled [115613]. 3. The ransomware attack on Baltimore's city government computer systems was caused by hackers seizing parts of the systems and encrypting critical files remotely until a ransom was paid [84782]. 4. The cyberattack on 22 small Texas towns was a ransomware attack, where hackers remotely blocked access to important data until a ransom was paid [88390].
Non-software Causes 1. Colonial Pipeline lacked a dedicated ransomware response plan despite spending an average of $40 million annually on cybersecurity [115613]. 2. The compromised password used by the hackers was associated with a disused virtual private networking account that did not have multi-factor authentication [115613]. 3. The attack was attributed to a criminal extortion ring, DarkSide, which demanded a financial payment in exchange for a key to unlock the impacted systems [115613]. 4. Colonial Pipeline paid a ransom of $4.4 million to the hackers without a complete understanding of how deeply their systems had been compromised [115613].
Impacts 1. The ransomware attack on Colonial Pipeline led to the shutdown of its operations for five days, causing panic buying and widespread gas station outages in the Southeast, resulting in gas shortages and rising prices [115613]. 2. The attack on Colonial Pipeline prompted the company to pay a ransom of $4.4 million to the hackers to unlock its IT systems, leading to financial losses [115613]. 3. The cyberattack on Colonial Pipeline highlighted the crippling impact of ransomware on businesses and vital services throughout the US, showcasing the increasing success of criminals targeting large enterprises [115613]. 4. The attack on Colonial Pipeline exposed vulnerabilities in the company's cybersecurity measures, including the lack of a dedicated ransomware response plan and the compromised password used for remote access [115613]. 5. The incident demonstrated the challenges faced by US authorities in changing the calculus of ransomware victims and reducing the financial pressure to give in to hackers' demands [115613].
Preventions 1. Implementing a dedicated ransomware response plan and regularly conducting drills to ensure preparedness for such incidents could have helped prevent the software failure incident [115613]. 2. Enforcing multi-factor authentication for all remote access accounts, including disused accounts, could have prevented unauthorized access to the company's systems [115613]. 3. Maintaining up-to-date cybersecurity measures, including regular software updates and patches, could have potentially prevented the ransomware attack on the company's systems [115613]. 4. Having robust data backup systems in place, including offline backups, could have mitigated the impact of the ransomware attack and reduced the need to pay the ransom [115613].
Fixes 1. Implementing a dedicated ransomware response plan and ensuring regular backups of data to prevent future attacks [115613]. 2. Enhancing cybersecurity measures, including multi-factor authentication and strong password policies, to protect against unauthorized access [115613]. 3. Considering legislative measures, such as banning ransom payments, to deter cybercriminals and reduce financial incentives for attacks [115613]. 4. Increasing transparency and communication with law enforcement to respond swiftly to cyber incidents and contain the impact [115613].
References 1. Colonial Pipeline CEO Joseph Blount - Testimony before Senate and House committees [115613] 2. Texas Department of Information Resources [88390] 3. Energy Secretary Jennifer Granholm [115613] 4. Mandiant (cybersecurity firm hired by Colonial Pipeline) [115613]

Software Taxonomy of Faults

Category Option Rationale
Recurring multiple_organization (a) In the case of Colonial Pipeline, the company faced a ransomware attack in May 2021, which led to a shutdown of its operations for five days. The CEO, Joseph Blount, defended the decision to pay a ransom of $4.4 million to the hackers to unlock the IT systems. Blount mentioned that the company did not have a dedicated ransomware response plan despite spending an average of $40 million annually on cybersecurity. The attack compromised the company's computer networks, and the hackers demanded a financial payment in exchange for a key to unlock the impacted systems. The decryption key provided by the hackers worked to some degree, but it was not a perfect tool. The FBI and Department of Homeland Security were involved in the investigation, and US investigators managed to recover millions of dollars in cryptocurrency allegedly paid in ransom to the hackers [115613]. (b) The cyberattack on Colonial Pipeline was part of a growing trend of ransomware attacks targeting local governments, businesses, and vital services throughout the US. The incident highlighted the crippling impact ransomware can have on large enterprises. The attack on Colonial Pipeline was followed by a cyberattack on a major US meat producer, indicating the success criminals have had in targeting large organizations. Ransomware attacks have been increasing in both scope and sophistication, posing a significant threat to businesses and critical services. The incident prompted the Justice Department to recover millions of dollars in cryptocurrency paid in ransom to the criminal group DarkSide, which was responsible for the attack on Colonial Pipeline. The attack on Colonial Pipeline exposed the vulnerability of critical infrastructure to cyber threats and the challenges in preventing and responding to ransomware attacks [115613].
Phase (Design/Operation) design, operation (a) In the case of the Colonial Pipeline ransomware attack, the failure was primarily due to a compromised password associated with a disused virtual private networking account used for remote access. This compromised password allowed hackers initial access to the company's computer networks. The password was linked to a legacy VPN platform and was not guarded by multi-factor authentication. The attack occurred in April, and the compromised password was not a weak password but rather a complex one. This design flaw in the system's security measures contributed to the software failure incident [115613]. (b) The operation phase of the Colonial Pipeline ransomware attack also played a significant role in the software failure incident. After the ransomware attack, Colonial Pipeline made the decision to shut down its operations to prevent further spread of the malware and to assess the extent of the damage. The decision to pay the ransom was influenced by the time it would take to determine the full impact of the attack, as even with data backups, it would have taken days to understand the depth of the compromise. This operational response, including the decision-making process during the attack, contributed to the software failure incident [115613].
Boundary (Internal/External) within_system, outside_system [a115613] The software failure incident involving Colonial Pipeline was a result of a ransomware attack that compromised the company's computer networks. The attackers gained access to the system using a compromised password associated with a disused virtual private networking account. This compromised password was linked to a legacy VPN platform and did not have multi-factor authentication, making it vulnerable to the attack. This indicates that the failure originated from within the system, specifically due to the lack of proper security measures in place. Additionally, the attack exposed the vulnerability of the company's IT systems, highlighting the importance of acting swiftly to identify and contain malicious software to prevent further damage.
Nature (Human/Non-human) non-human_actions, human_actions (a) non-human_actions: - The software failure incident involving the Colonial Pipeline was due to a ransomware attack by the DarkSide criminal group, where hackers remotely blocked access to important data until a ransom was paid [115613]. - The attack on the Texas towns involved a ransomware attack, where hackers remotely encrypted critical files until a ransom was paid [88390]. - The attack on Baltimore's government systems was a ransomware attack where critical files were encrypted remotely until a ransom was paid [84782]. (b) human_actions: - Colonial Pipeline CEO Joseph Blount admitted that the company did not have a dedicated ransomware response plan despite spending an average of $40 million annually on cybersecurity [115613]. - The compromised password that enabled the initial access for the ransomware attack on Colonial Pipeline was associated with a disused virtual private networking account and was not guarded by multi-factor authentication [115613]. - The Texas Department of Information Resources mentioned that the ransomware attack on 22 small Texas towns was a coordinated cyberattack, indicating human involvement in introducing the contributing factors [88390].
Dimension (Hardware/Software) software (a) In the software failure incident related to the Colonial Pipeline cyberattack, the incident occurred due to a ransomware attack that locked up the company's IT systems, leading to the shutdown of its operations. The attack was attributed to the DarkSide ransomware gang, which demanded a ransom for a key to unlock the impacted systems [115613]. (b) The software failure incident involving the 22 small Texas towns being hacked and held for ransom was due to a ransomware attack, where hackers remotely blocked access to important data until a ransom was paid. The attack affected certain agencies in the towns, not entire government computer systems, and the attacker was described as "one single threat actor" [88390].
Objective (Malicious/Non-malicious) malicious - The software failure incident involving Colonial Pipeline was considered a malicious attack. Hackers remotely blocked access to important data until a ransom was paid, which is a characteristic of a ransomware attack [115613]. - The ransomware attack on Baltimore's government systems was also a malicious incident where critical files were encrypted remotely until a ransom was paid [84782]. - The cyberattack on 22 small Texas towns was a ransomware attack, where hackers remotely blocked access to important data until a ransom was paid [88390].
Intent (Poor/Accidental Decisions) accidental_decisions [a] The intent of the software failure incident was not to disrupt the economy by taking the pipeline offline but to hold corporate data for ransom. The attackers were criminals seeking financial gain through ransomware, and the goal was to get the encryption tool and information back after the ransom was paid. The decision to pay the ransom was made to restore service quickly due to the worsening disruption to the US fuel supply caused by the attack ([115613], [115613]). [b] The software failure incident was a ransomware attack where hackers remotely blocked access to important data until a ransom was paid. The attack was a coordinated cyberattack on 22 small Texas towns, affecting certain agencies in those towns. The attack was not random, and the hackers demanded a financial payment in exchange for a key to unlock the impacted systems. The attack began on a Friday morning, and Governor Greg Abbott ordered the second-highest level of alert in the state’s emergency-response system ([88390], [88390]).
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident occurring due to development incompetence: - Colonial Pipeline suffered a ransomware attack due to a compromised password associated with a disused virtual private networking account lacking multi-factor authentication, highlighting a lack of professional competence in maintaining secure access controls [115613]. - The attack on Baltimore's city government systems was a ransomware attack, where critical files were encrypted remotely until a ransom was paid, showcasing a failure in maintaining robust cybersecurity measures [84782]. (b) The software failure incident occurring accidentally: - The cyberattack on Baltimore's government systems was a ransomware attack discovered on May 7, indicating the attack was introduced accidentally through malicious emails or links clicked by employees [84782]. - The ransomware attack on 22 small Texas towns was described as a ransomware attack, where hackers remotely blocked access to important data until a ransom was paid, suggesting an accidental introduction of the attack through compromised systems [88390].
Duration temporary In the case of the Colonial Pipeline cyberattack incident, the software failure incident was temporary. The pipeline was shut down for five days due to the ransomware attack, causing disruptions in fuel supplies and leading to panic buying and gas station outages in the Southeast [Article 115613]. On the other hand, the cyberattack on 22 small Texas towns resulted in a temporary software failure incident as well. The affected entities were able to bring their systems back online, and several government agencies were back to "operations as usual" after the attack [Article 88390].
Behaviour omission, byzantine (a) crash: The Colonial Pipeline incident involved a ransomware attack that led to the shutdown of the pipeline's operations, causing panic buying and widespread gas station outages in the Southeast. The system was compromised, leading to a loss of access to important data until a ransom was paid. The company had to shut down the pipeline due to concerns about the malware affecting its back-office functions, impacting billing for fuel and potentially spreading into the pipeline's operating system [115613]. (b) omission: The ransomware attack on Baltimore's government systems resulted in critical files being encrypted remotely until a ransom was paid, leading to disruptions in the city's operations. The attack affected parts of the computer systems that run the city's government, causing delays in delivering water bills and preventing the Health Department from issuing critical alerts [84782]. (c) timing: The cyberattack on the Texas towns involved a ransomware attack that led to the remote blocking of access to important data until a ransom was paid. The attack began on a Friday morning, prompting Governor Greg Abbott to order the second-highest level of alert in the state's emergency-response system, classifying the attack as a Level 2 Escalated Response due to the scope of the incident [88390]. (d) value: The Colonial Pipeline incident involved a ransomware attack where hackers demanded a financial payment in exchange for a key to unlock the impacted systems. Colonial paid a ransom of $4.4 million to the hackers, highlighting the financial impact of the attack on the company [115613]. (e) byzantine: The cyberattack on Baltimore's government systems involved hackers seizing parts of the computer systems and encrypting critical files remotely until a ransom was paid. The attack was a ransomware attack, where the hackers demanded payment in exchange for unlocking the encrypted data, showcasing the inconsistent responses and interactions typical of such attacks [84782]. (f) other: The cyberattack on the Texas towns was described as a ransomware attack, where hackers remotely blocked access to important data until a ransom was paid. The attack affected certain agencies in the 22 towns, not entire government computer systems, and the ransomware virus appeared to have common threads among the entities targeted, indicating a coordinated attack [88390].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence basic, property, delay, non-human, theoretical_consequence, other (a) death: There were no reports of people losing their lives due to the software failure incident in the articles. (b) harm: There were no reports of people being physically harmed due to the software failure incident in the articles. (c) basic: The software failure incident impacted people's access to fuel, leading to gas shortages and panic buying at gas stations on the East Coast [127937]. (d) property: The software failure incident led to a ransom payment of nearly $5 million in cryptocurrency by Colonial Pipeline to the hackers [115482]. (e) delay: The software failure incident caused disruptions in the operations of Colonial Pipeline, leading to a shutdown for five days and delays in restoring services [115482]. (f) non-human: The software failure incident impacted the computer systems of Colonial Pipeline, leading to a ransomware attack and seizure of IT systems [115482]. (g) no_consequence: The software failure incident had real observed consequences, such as the shutdown of Colonial Pipeline operations and gas shortages on the East Coast [127937, 115482]. (h) theoretical_consequence: There were potential consequences discussed, such as the impact on critical infrastructure, transportation, and the economy if the pipeline remained shut down for an extended period [115482]. (i) other: The software failure incident highlighted the vulnerability of critical infrastructure to cyberattacks and the need for improved cybersecurity measures [115482].
Domain transportation, utilities, finance, government (a) The failed system was intended to support the transportation industry. The Colonial Pipeline, a major US fuel pipeline, was targeted in a ransomware cyber-attack, leading to a shutdown of operations and causing disruptions in the fuel supply across the US East Coast [114505]. (g) The failed system was intended to support the utilities industry. The Colonial Pipeline, a critical infrastructure for transporting gasoline, jet fuel, and diesel, was impacted by the ransomware attack, leading to disruptions in fuel supplies and causing panic buying at gas stations [115193]. (l) The failed system was intended to support the government industry. The cyberattack on Baltimore's city government resulted in parts of the computer systems being seized and held for ransom, affecting critical files and services [84782]. Additionally, the cyberattack on 22 small Texas towns targeted government agencies, leading to a widespread, coordinated ransomware attack on government computer systems [88390]. (m) The failed system was also related to the finance industry. The ransomware attack on Colonial Pipeline, a critical fuel infrastructure, led to the company paying a ransom of nearly $5 million to hackers to unlock its IT systems, highlighting the financial impact and challenges faced by companies dealing with cyberattacks [114505].

Sources

Back to List