Organizations that are unprepared for cyberattacks often suffer the hardest from the consequences. The effects of these attacks can also be felt by more than just the targeted businesses. One notable example is the Colonial Pipeline attack in 2021 that managed to shut down the largest oil pipeline in the United States.
What are the Costs of Unpreparedness
The attack occurred in May of 2021 when a group of hackers known as “DarkSide” obtained access to Colonial Pipeline’s network via a compromised VPN password. It took only 120 minutes for the hackers to steal 100GB of data from the organization. Afterwards, DarkSide hit the company’s computers with ransomware.
Consequently, Colonial Pipeline, which was not prepared for the attack, had to shut down their entire pipeline, cutting off an important fuel line for millions of Americans. The organization had to bring in an outside security firm to help investigate. Still, Colonial Pipeline paid a 75 BTC ransom (worth around $4.4 million at the time).
There are several lessons we can learn from this incident. For one, depending on ransom payments for recovery is risky. The CEO of the organization said they paid the ransom because they lacked clear recovery timelines. This highlights the importance of businesses having an Incident Response Plan in place before an attack occurs. A comprehensive IR plan makes it possible to manage manual reboots and prevent an entire system shutdown while an IT infrastructure attack is underway.
The compromised VPN password that the attackers used to infiltrate the system also had no multi-factor authentication in place. Simple security hygiene such as MFA could have prevented the breach from happening. This highlights the importance of securing all potential threat vectors.
In this case, experts believe the hackers (DarkSide) were not a state-sponsored group. DarkSide later claimed they did not intend to cause social disruption. Do you think “financially motivated” attacks are more dangerous than state-sponsored attacks because of their unpredictability?
References
- INSURICA. (2024). Cyber case study: Colonial Pipeline ransomware attack. insurica.com