Colonial Pipeline paid $4.4M in ransom — because it couldn't find the backup

In May 2021, the Colonial Pipeline — the largest refined fuel pipeline in the US, carrying 45% of the East Coast's gasoline, diesel and jet fuel — was shut down after a ransomware attack by the DarkSide criminal group. The attackers encrypted Colonial's billing and IT systems, and the company took the pipeline offline as a precaution.

The shutdown lasted six days, causing fuel shortages, panic buying and price spikes across the US East Coast. Colonial paid approximately $4.4 million in Bitcoin ransom to obtain the decryption key. The FBI later recovered approximately $2.3 million of the ransom by tracing the Bitcoin transaction.

The case exposed the vulnerability of critical infrastructure to cyberattack and the danger of inadequate backup and recovery systems. Colonial's decision to pay the ransom was controversial: it restored operations faster but funded criminal activity and set a precedent. The attack prompted the US government to elevate cybersecurity for critical infrastructure and to treat ransomware as a national security threat.