On 7 May 2021 a ransomware attack hit Colonial Pipeline in the United States, and fuel shortages followed along the eastern seaboard. CISA and the FBI later said the ransomware hit the company's IT network and that it disconnected some operational technology systems as a precaution. The lessons are about segmentation, remote access and recovery.
What do we know happened?
We limit this to what the cited agencies say.
- 7 May 2021: A ransomware attack hit Colonial Pipeline. CISA's later retrospective describes long lines of cars at gas stations along the eastern U.S. seaboard and people stockpiling fuel.
- 11 May 2021: CISA and the FBI published joint advisory AA21-131A on DarkSide ransomware. It refers to "a pipeline company" in the United States, and the company name appears only in a cited media statement.
- What the advisory says about the systems: DarkSide ransomware was deployed against the company's IT network. The company proactively disconnected certain operational technology systems for safety. The advisory states there was no indication that the OT networks were directly affected, and no sign the attacker moved laterally into them. The analysis was ongoing when the advisory was published.
How did the attackers get in?
The advisory does not say. It notes that, per open source reporting, DarkSide actors have previously gained initial access through phishing, exploiting public facing applications and abusing external remote services including virtual desktop infrastructure. It also says they have used Remote Desktop Protocol for persistence. Be careful not to read those as the confirmed route into this company, because the advisory does not claim that.
Why did an IT attack stop a pipeline?
The advisory's wording is cautious: the company disconnected OT systems proactively. The broader lesson is dependency. When business systems that schedule, bill and track product go down, running the physical process safely may become hard even if the control systems are untouched. Whether you can operate manually is a question to answer before an incident.
What does CISA recommend?
The advisory splits its mitigations into prevention and resilience.
Preventive steps include requiring multi-factor authentication for remote access to IT and OT networks, restricting RDP and requiring multi-factor authentication where it is needed, updating software promptly with centralized patch management, filtering email and training users, and application allowlisting.
Resilience steps include network segmentation between IT and OT with a demilitarized zone, organizing OT assets into logical zones and keeping industrial protocols off the IT network, identifying IT and OT interdependencies and developing workarounds or manual controls, and regularly testing those manual controls. The advisory also says to back up IT and OT data frequently, test the backups and store them offline, and to apply least privilege.
On response, it says to isolate infected systems and secure backups, and that CISA and the FBI do not encourage paying ransoms.
What did CISA say it learned?
In a May 2023 retrospective, CISA's director and a partner from industry wrote that technology should be secure by design, that cybersecurity should be a leadership priority for boards, and that government and industry should share threat information by default. CISA lists actions since the attack, including the StopRansomware.gov site, a Joint Ransomware Task Force with the FBI and the Joint Cyber Defense Collaborative.
What does this mean for software teams?
Most software companies are not pipeline operators, but the pattern applies. Know which of your systems are reachable remotely and protect those with strong authentication. Keep a list of what you run so that patching is quick. Separate the systems that build and release software from the corporate network. And test whether you can ship a fix when your normal tooling is down. Safeguard's inventory and scanning can help you know what you run, but segmentation and recovery are architecture choices.
What to do
- List every remote access path into your environment and require multi-factor authentication on each.
- Close or restrict RDP and other remote services you do not need.
- Separate critical production networks from office networks.
- Write down which business systems your operations depend on, and plan manual workarounds.
- Keep offline, tested backups and rehearse a restore.
- Apply least privilege to accounts and review them.
- Decide in advance who may order a precautionary shutdown.
Quick check
Did the attack reach the pipeline control systems?
The CISA and FBI advisory says there was no indication that operational technology networks were directly affected. The company disconnected some OT systems proactively.
Do we know how the attackers got in?
Not from the advisory. It lists methods DarkSide has used before, but does not state the route in this case.
Sources
- CISA and FBI advisory AA21-131A, DarkSide ransomware
- CISA: Attack on Colonial Pipeline, what we've learned and what we've done over the past two years
Last reviewed: 18 October 2026.
