According to CISA and the FBI, the pipeline company proactively disconnected certain OT systems for safety, and there were no indications the threat actor moved laterally into OT. An IT compromise still disrupted operations, which is why IT and OT dependencies belong in your continuity plan.
The source
CISA and the FBI published advisory AA21-131A on 11 May 2021, revised on 8 July 2021, titled DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks. It describes the victim only as a pipeline company in the United States. The company is named only in the reference titles, so this post sticks to what the advisory itself states.
Myth: the attackers took control of the pipeline
Fact: the advisory says there was no indication the attacker moved laterally to OT systems, and that the company chose to disconnect certain OT systems to keep them safe. The attack succeeded in disrupting the business without touching the controllers, as far as the advisory reports.
Myth: OT is safe if the attacker never reaches it
Fact: the same advisory is about preventing business disruption. When IT systems that support billing, scheduling or monitoring are down, operators may have to stop or slow physical work. Its mitigations tell owners to identify IT and OT interdependencies, develop workarounds, and regularly test manual controls so OT can operate at necessary capacity if IT is compromised.
How access was reported
The advisory cites open source reporting of initial access through phishing, exploitation of public facing applications, and external remote services, including remotely accessible accounts and virtual desktop infrastructure. It also notes RDP used for persistence.
What to take from it
- Map which IT services each plant process depends on. Include identity, DNS, time, file shares and licensing.
- Decide in advance who may disconnect OT, and what the trigger is.
- Segment IT and OT with a DMZ, define zones and conduits, and keep ICS protocols off the IT network.
- Require multifactor authentication for remote access, and restrict RDP.
- Keep backups offline and tested, along with gold images and spare hardware.
- Test manual operation until the crew can do it calmly.
Myth: the fix is a bigger perimeter
Fact: the advisory's mitigations are a mix. Segmentation and MFA reduce the chance of spread, while backups, manual controls and tested workarounds reduce the cost when something fails anyway. Plan for both outcomes rather than relying on prevention alone.
Why the wording matters
It is tempting to retell a famous incident with more drama than the record supports. For planning, the accurate version is more useful: a business side compromise, a cautious decision about operational systems, and a lesson about dependencies. Check any account you read against the primary advisory, which names no further detail about the company.
Quick check
If OT was not compromised, why does this matter to OT teams?
Because the decision to disconnect and the loss of IT dependencies can stop operations even when controllers are untouched.
What is the cheapest preparation?
A written map of IT dependencies for each process, plus a manual operation drill.
Sources
Last reviewed: 19 October 2026.
