DarkSide Stopped America's Fuel Pipeline

There is a river in America that nobody can see. It does not flow through valleys or under bridges. It flows inside a giant metal pipe, and instead of water it carries petrol — millions of litres of it, every single day, travelling from the oil fields of Texas up to the crowded cities of the East Coast.

If you live in that part of the country, this hidden river decides whether your car moves. It fills the tankers that serve filling stations, and it even carries jet fuel to busy airports. Life along the route runs on its rhythm, so steady and so quiet that most people never think about it at all.

Then, in May 2021, the river stopped.

Nothing had exploded. No storm had torn the pipe open, and no workers had gone on strike. The pipe itself was perfectly healthy. What failed was something far smaller and far stranger: a single password, sitting in a leaked list, attached to an account the company no longer even used. Through that forgotten door walked a gang of criminals who called themselves DarkSide — and within days, millions of ordinary drivers were standing in long queues at filling stations, watching pumps run dry.

This is the story of how the biggest fuel shutdown in American history began with one of the smallest mistakes in computer security.

Who DarkSide was, and what its ransomware did

DarkSide was not a lone hacker in a dark room. It worked more like a shady business. Its creators built a piece of ransomware — software designed to lock up a victim’s computer files — and then rented that software out to other criminals, who are called affiliates in this world. The affiliates did the breaking in. When a victim paid, DarkSide’s creators took a share of the money, like a landlord collecting rent from tenants who use his tools for crime.

The rented tool did a brutal but simple job. Once it got loose inside a company’s network, it scrambled the files it found, turning readable documents, records and systems into locked gibberish. The only way back was a special digital key, and the gang held that key. A message would appear telling the victim to pay in Bitcoin if they ever wanted their files — and their business — working again.

That is what makes ransomware so frightening: a locked company and a ticking clock. Every hour a business stays frozen, it bleeds money. DarkSide’s victims were not just losing files; they were losing time, customers and trust, all at once.

The gang had also built a public image for itself. On its own page, DarkSide presented its members as “professionals” and claimed it only attacked companies rich enough to pay, while sparing hospitals, schools and governments. Those were the gang’s own claims — and a claim on a criminal’s website is worth exactly what you would expect. What the gang proved in May 2021 was not professionalism. It proved reach.

The forgotten door into Colonial Pipeline

Now, how does a gang like that get inside the largest fuel pipeline system in the United States? You might picture a team of geniuses battering down digital walls for months. Investigators who studied the attack reported something much less dramatic — and much more worrying, because it could happen almost anywhere.

The attackers reportedly came in through a virtual private network account. A virtual private network, or VPN, is a private tunnel that lets an employee connect to the company network from outside, like a staff entrance at the back of a building. This particular account was no longer used by the company. It was a leftover — the digital version of an old staff key nobody had collected and destroyed.

Worse, the password guarding that account had appeared in a batch of leaked passwords. Passwords leak all the time, when websites get breached and their login lists escape onto the internet. Criminals collect these lists and simply try the passwords against other doors, because people and companies often leave the same keys working in many places. And this account had nothing behind the password — no second check, no code sent to a phone, nothing. One leaked password was the whole lock.

Picture a giant business park with guards, cameras and strong front gates, where around the back one rusty side door stands forgotten, fitted with a lock whose key copies are floating around town. That is the hole DarkSide walked through, according to what investigators reported afterwards.

Hold that picture in your mind, because the same hole exists in ordinary places. A small shop whose old employee still has a login. A family cloud account protected by a password that also guards an email account breached years ago. An online store account from a business that closed, still active on a supplier’s system. You do not need to run a pipeline to have a forgotten door — only to have stopped watching one.

Six days when the fuel stopped flowing

Colonial Pipeline shut its pipeline down on 7 May 2021, as a precaution, once the attack was discovered inside its systems. The company chose to stop the fuel rather than risk the attack spreading deeper while nobody yet understood its full size. The shutdown lasted about six days before the pipeline restarted — and it was reported as the first complete shutdown in the pipeline’s history.

Six days does not sound long. But remember the hidden river. The East Coast and the south-east of the United States draw a large share of their petrol and jet fuel from this one system. There is no spare river waiting beside it. When the flow stopped, the whole region began running on whatever fuel was already sitting in storage tanks — a countdown nobody could pause.

Then human nature took over. News of the shutdown spread fast, and drivers rushed out to fill their tanks before supplies failed. Queues formed at filling stations. People who normally bought a little fuel bought a lot, and people who needed none at all joined the lines anyway, out of fear. Station after station ran dry. The panic made the shortage worse than the shutdown alone would have, because fear empties tanks faster than any pipeline problem can.

While drivers queued, the company faced the gang’s demand. Colonial’s chief executive later confirmed that the company paid a ransom of about $4.4 million in Bitcoin — a decision he explained publicly, in Senate testimony and interviews, as one made to get the country’s fuel moving again. Paying a gang is an ugly choice, but from his seat, every silent day at the pumps was costing far more than the ransom.

The story has one more twist, and it is my favourite part of the whole affair. Bitcoin payments move across a public ledger that anyone can inspect — like a glass safe. In June 2021, the United States Department of Justice announced that its investigators had followed the money across that ledger and recovered about $2.3 million of the ransom by taking control of the digital wallet holding it. More than half the gang’s prize was snatched back from its own pocket.

And DarkSide itself? After the storm it had created, the group announced that it had lost control of its servers — and then it simply disappeared. The gang that had stopped a nation’s fuel found the heat far too hot to survive in the open.

How to protect yourself from a DarkSide-style break-in

You cannot guard a pipeline from your kitchen table, but you can guard the doors DarkSide actually used, because they are the same doors standing in your home and your small business right now.

Delete accounts you no longer use. Every old login is a door you have stopped watching. Go through the accounts connected to your business, your email and your important services. If an employee left, if a service closed, if an app is long gone — close the account or cut its access. A door that does not exist cannot be picked.

Turn on two-factor sign-in everywhere it exists. The Colonial account reportedly fell because a single password was the entire defence. Two-factor sign-in adds a second proof — usually a code on your phone — so a leaked password alone becomes nearly useless. Enable it on email first, then on banking, social media and any work systems. This one habit defeats the exact trick used in this famous attack.

Never reuse one password on many doors. Leaked password lists only work because the same password opens several locks. Use a different strong password for each important account. A password manager — a secure app that remembers them all — makes this easy even if your memory is ordinary.

Keep backups that live offline. Ransomware loses its power when you can rebuild without paying. Keep copies of your important files on a drive that is unplugged after each backup, or in a separate cloud account. Test that the backup actually opens; a broken backup is just a sad story waiting for its moment.

Treat every account like it still matters. Once a year, sit down and list where you have logins: suppliers, old email addresses, delivery apps, shop systems. You will almost always find doors you forgot you owned. Close them the same day.

None of this needs special skill or expensive tools. It needs only the habit of remembering your doors — all of them.

Common questions

Did DarkSide physically damage the pipeline?

No. The pipe and the fuel inside it were untouched. The attack locked up computer systems, and Colonial shut the pipeline down itself, as a precaution, until the situation was understood and safe. The damage was done to schedules, supplies and public calm — not to steel.

Why did drivers run out of fuel if the pipeline was only stopped for six days?

Because the region depends on a steady daily flow, and panic buying drained station tanks far faster than normal use. When thousands of people rush to fill up at once, even a short pause in supply turns into dry pumps and long queues within days.

Did Colonial Pipeline get its ransom money back?

Partly. The company paid about $4.4 million in Bitcoin, as its chief executive later confirmed. In June 2021 the US Department of Justice announced it had recovered about $2.3 million of that ransom by seizing the digital wallet that held it.

Can an ordinary person’s account really be a door for criminals?

Yes — that is exactly the lesson of this attack. The way in was reportedly a leftover account whose password had leaked, with no second check behind it. Small businesses and home users have the same weak spots: unused logins, reused passwords and sign-ins with no two-factor protection.

What happened to the DarkSide gang?

After the pipeline attack drew enormous attention from the United States government, the group announced it had lost control of its servers and vanished. Its public claims of being “professionals” who chose targets carefully did it no good once the world’s most powerful investigators came looking.

Sources

• Wikipedia — DarkSide (hacker group): https://en.wikipedia.org/wiki/DarkSide_(hacker_group)
• US Department of Justice — Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside: https://www.justice.gov/archives/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside