Colonial Pipeline, Years Later: The Lesson That Actually Stuck

In May 2021, Colonial Pipeline shut down the largest fuel pipeline in the United States after a ransomware attack, triggering gas shortages and panic-buying across the East Coast. The headline was the pipeline. The actual cause was much smaller.

How attackers actually got in

Investigators traced the intrusion to a single compromised password for a VPN account that didn’t have two-factor authentication enabled. The password wasn’t even actively in use — it belonged to an old account that was still valid, tied to a password reused from another breached site.

Why this detail matters more than the ransomware itself

Ransomware is the visible damage — the part that makes the news. The actual point of failure was mundane: no multi-factor authentication on a remote-access account, and a password that had already been exposed somewhere else. That’s not a sophisticated nation-state technique. It’s the same failure that causes most breaches, at any scale.

The takeaway that applies whether you run a pipeline or a laptop

• Old accounts are still doors. If it can still log in, it can still be used against you — deactivate what you don’t use.
• MFA is the cheapest fix with the biggest payoff. A stolen password alone should never be enough to get in anywhere that matters.
• Password reuse is the common thread in an enormous share of major breaches, infrastructure or otherwise. One unique password per account remains the boring, unglamorous fix that actually works.