---
title: Colonial Pipeline Ransomware and Identity Management
description: This article analyzes the Colonial Pipeline ransomware attack in light of failing around proper user identity management.
image: https://blog.tuebora.com/hubfs/winter-681175_640.jpg
---
[](https://tuebora.com/)
[](https://tuebora.com/)
[](https://tuebora.com/)
- Platform
[IVIP (Identity Visibility & Intelligence Platform) New The intelligence spine of Tuebora](https://tuebora.com/platform/ivip) [Tuebora Studio New The design plane for IAM - the "Cursor" for IAM](https://tuebora.com/platform/studio) [AI Agent Framework New Policy-bound AI agents that execute identity workflows with governance](https://tuebora.com/platform/ai-agent-framework) [Experience & Interaction Layer Role-based interfaces and conversational access for every stakeholder](https://tuebora.com/platform/experience-layer)
- Solutions
Core Governance
[Access Governance Unified requests, reviews, and controls with continuous monitoring](https://tuebora.com/solutions/access-governance) [Identity Lifecycle Management Automate joiner, mover, and leaver processes with policy-driven governance](https://tuebora.com/solutions/lifecycle-management) [Compliance & Audit Continuous compliance with automated evidence and real-time visibility](https://tuebora.com/solutions/compliance-audit)
Advanced & AI-Driven
[Non-Human & AI Identity Governance New Govern machine, application, and AI identities with full lifecycle control](https://tuebora.com/solutions/non-human-identity-governance) [AI Agent Governance New Policy-driven control for what AI agents can access, decide, and execute](https://tuebora.com/solutions/ai-agent-governance) [Conversational Access (AskTuebora) Request, approve, and manage access through natural language](https://tuebora.com/solutions/conversational-access)
- Resources
[Use Cases Real-world identity governance scenarios](https://tuebora.com/resources/use-cases) [Whitepapers In-depth technical insights and innovative approaches](https://tuebora.com/resources/whitepapers) [Blog Insights and thought leadership in AI-driven IGA](https://blog.tuebora.com/) [Documentation Comprehensive platform documentation and PDFs](https://tuebora.com/resources/docs)
- Customers
[Our Customers Leading enterprises that choose Tuebora for identity governance](https://tuebora.com/customers/our-customers) [Customer Portal Knowledge base, documentation, and support requests](https://support.tuebora.com/hc/en-us)
- Company
Company
[About Our mission, values, and what we believe about identity](https://tuebora.com/company/about) [Leadership Meet our founders, leadership team, and advisors](https://tuebora.com/company/leadership) [Careers Join the team building modern identity systems](https://tuebora.com/company/careers) [Life at Tuebora Culture and what it's like to work here](https://tuebora.com/company/life) [Contact Talk to sales, support, or our team](https://tuebora.com/company/contact)
Partners
[Our Partners Resellers, service providers, and global SIs partnering with Tuebora](https://tuebora.com/partners/our-partners) [Partner Program Earn commissions delivering Agent-Driven IGA to your clients](https://tuebora.com/partners/partner-program)
- [Editions](https://tuebora.com/pricing)
[Get a Demo](https://offers.tuebora.com/tuebora-iga-schedule-demo) [Request a POC](https://offers.tuebora.com/schedule-poc)
Tuebora Blog
# Insights & Blog
Welcome to the Tuebora blog. As pioneers in leveraging AI Agents for smarter, faster, and more adaptive identity management, we aim to empower businesses to secure their digital ecosystems with precision and efficiency. Here we strive to inform and inspire our readers with insights into the latest innovations, emerging trends, and transformative ideas in the IGA space. You'll discover how Tuebora not only anticipates industry shifts but also pioneers new concepts that challenge traditional approaches to identity governance. Let us guide you through the evolving landscape of IGA, where our expertise helps bridge the gap between complex challenges and practical, forward-thinking solutions.
[Get a Demo](https://offers.tuebora.com/tuebora-iga-schedule-demo)
[](https://blog.tuebora.com/colonial-pipeline-ransomware-and-identity-management)
## 15
### Jun
2021
### [Colonial Pipeline Ransomware and Identity Management](https://blog.tuebora.com/colonial-pipeline-ransomware-and-identity-management)
[Ronan Mahony](https://blog.tuebora.com/author/ronan-mahony)
[0 Comments](https://blog.tuebora.com/colonial-pipeline-ransomware-and-identity-management#comments-listing)
[IAM](https://blog.tuebora.com/tag/iam), [Identity Governance](https://blog.tuebora.com/tag/identity-governance), [Identity and Access Management](https://blog.tuebora.com/tag/identity-and-access-management), [Tuebora](https://blog.tuebora.com/tag/tuebora), [Zero trust](https://blog.tuebora.com/tag/zero-trust), [ransomware](https://blog.tuebora.com/tag/ransomware), [Orphaned Accounts](https://blog.tuebora.com/tag/orphaned-accounts)
- [Tweet](https://twitter.com/share)
# Analyzing the Colonial Pipeline Cyber Attack from An Identity Management Perspective
The cyber attack that hit Colonial Pipeline is one of the most severe instances of ransomware to hit critical American infrastructure in history. Resulting in operational disruption and the payment of a ransom, this incident will be talked about for years. Read on to get an overview of what happened, an identity management perspective on the attack, and some takeaway cybersecurity lessons.
## What Happened in the Colonial Pipeline Attack?
The Colonial Pipeline carries diesel, gas, and even jet fuel from Texas to the East Coast. Operating the pipeline is the Colonial Pipeline
targeted the IT system used to manage billing for the pipeline. An employee noted a message on their computer screen demanding a cryptocurrency payment. Within just over an hour, operators shut down the entire pipeline system for the first time in its history as a precaution.
The perpetrators of the attack were a for-profit hacking group from Eastern Europe known as DarkSide. The group stole around 100 gigabytes worth of data and encrypted it. The payment demanded to return the stolen information was 75 bitcoins, which amounted to approximately $5 million at the time of the attack.
The Biden-Harris administration noted the severity of this incident and launched a [government response](https://www.whitehouse.gov/briefing-room/statements-releases/2021/05/11/fact-sheet-the-biden-harris-administration-has-launched-an-all-of-government-effort-to-address-colonial-pipeline-incident/) to protect critical energy supply chains. Operations at the pipeline only resumed after an enforced 5-day shutdown that causes fuel shortages and long queues to line up outside gas stations.
## Identity Management Blunders
The Colonial Pipeline attack occurred due to some surprising cybersecurity blunders around identity management. The DarkSide group gained access to the Colonial Pipeline IT environment remotely using a virtual private network (VPN) account. By logging into the account using stolen credentials, the hackers could access the network.
A VPN creates a tunnel between an employee’s device and a network. Employees can use a VPN to retrieve files that were previously shared within a private network. The use of VPNs has become far more widespread with the rapid change to work-from-home arrangements enforced by the Covid pandemic.
While some speculation remains about how the password for the VPN account was compromised, the same password appeared in a batch of stolen passwords from a separate password leak on the dark web. On this “underworld” part of the Internet, cybercriminals often engage in trading stolen credentials for cryptocurrency payments.
From an identity management perspective, two key failures from the Colonial Pipeline incident immediately became obvious:
**#1. Orphaned account**
According to a Bloomberg report quoting Charles Carmakal of FireEye, the compromised account was, “no longer in use at the time of the attack but could still be used to access Colonial’s network.”
In the world of identity management, user accounts with no valid business owners are termed [orphaned or ghost accounts](https://blog.tuebora.com/the-scourge-of-orphaned-accounts). These accounts carry several security risks, including increasing the attack surface for hackers into a network and offering unfettered access to certain resources on a network. In the worst-case scenario, an orphaned account can have privileged access that enables a hacker to compromise the most sensitive information.
**#2. No Multifactor Authentication**
A tenet of modern secure identity management is that users should have to present more than one distinct type of information to gain access to a system. Otherwise known as multifactor authentication, this basic cybersecurity defense mechanism was not in place for the compromised VPN account on the Colonial Pipeline network.
If all an attacker needs is a set of username-password credentials to access a system, that system becomes far more susceptible to breaches. While it’s not known how DarkSide found the correct username, it’s not a stretch to assume that they determined it on their own using some simple guesswork.
Such blunders are commonplace in small to medium-sized businesses, but at the scale of critical infrastructure, it’s somewhat disconcerting to see these basic cybersecurity mistakes.
## Takeaway Lessons from The Colonial Pipeline Ransomware Attack
As with any high-profile cybersecurity attack, there are several takeaway lessons to learn and implement at your own organization, such as:
- **Regular Access Reviews**—It’s crucial to perform regular reviews of user access privileges to ensure the right people have the right levels of access to IT resources.
- **Least Privileges**—Prudent access management ensures that employees only have the level of access strictly required to carry out their duties.
- **Never Rely on Passwords Alone**—Passwords do not provide sufficient hardening of your security defenses; always use multifactor authentication to protect systems and data.
- **Analytics-Powered Management**—In an ideal world, behavioral analytics solutions can find user accounts with unused access and disable that access automatically before an attacker ever gets the chance to find orphaned accounts.
- **Ransomware Is Not Going Away**—As ransomware-as-a-service continues to proliferate on the dark web and successful attacks make media headlines continually, ransomware is not going away as a cybersecurity threat.
**How Tuebora Can Help**
Whether you’re running an industrial pipeline or a commercial business, it’s crucial that you properly manage user identities and access to your network and the resources on that network. Tuebora’s IAM platform provides self-service workflows to give you visibility, SSO and MFA capabilities, and account behavioral analytics to proactively suggest accounts that should be deprovisioned based on lack of use. These are only a few of the many capabilities of Tuebora's microservices covering the entire IAM lifecycle. Using our services platform puts you in control.
[Contact us today for a demonstration](https://offers.tuebora.com/get-a-demo).
If you enjoyed this post, please consider [leaving a comment](https://blog.tuebora.com/colonial-pipeline-ransomware-and-identity-management#comments-listing) or [subscribing to the RSS feed](https://www.tuebora.com/blog/feed/) to have future articles delivered to your feed reader.
## Leave a Reply
### Feeds
### Popular Posts
### Archives
- [August 2026 (1)](https://blog.tuebora.com/archive/2026/08)
- [August 2025 (1)](https://blog.tuebora.com/archive/2025/08)
- [May 2025 (1)](https://blog.tuebora.com/archive/2025/05)
- [October 2024 (1)](https://blog.tuebora.com/archive/2024/10)
- [August 2024 (2)](https://blog.tuebora.com/archive/2024/08)
- [May 2024 (1)](https://blog.tuebora.com/archive/2024/05)
- [March 2024 (1)](https://blog.tuebora.com/archive/2024/03)
[](https://tuebora.com/)
Identity Intelligence. Executed.
Policy-driven, explainable identity governance with agent-based execution across your apps, cloud, and infrastructure.
[Get a Demo](https://offers.tuebora.com/tuebora-iga-schedule-demo) [Request a POC](https://offers.tuebora.com/schedule-poc)
#### Platform
- [IVIP](https://tuebora.com/platform/ivip)
- [Tuebora Studio](https://tuebora.com/platform/studio)
- [AI Agent Framework](https://tuebora.com/platform/ai-agent-framework)
- [Experience & Interaction Layer](https://tuebora.com/platform/experience-layer)
#### Solutions
- [Access Governance](https://tuebora.com/solutions/access-governance)
- [Identity Lifecycle Management](https://tuebora.com/solutions/lifecycle-management)
- [Compliance & Audit](https://tuebora.com/solutions/compliance-audit)
- [Non-Human & AI Identity Governance](https://tuebora.com/solutions/non-human-identity-governance)
- [AI Agent Governance](https://tuebora.com/solutions/ai-agent-governance)
- [Conversational Access](https://tuebora.com/solutions/conversational-access)
#### Resources
- [Use Cases](https://tuebora.com/resources/use-cases)
- [Whitepapers](https://tuebora.com/resources/whitepapers)
- [Blog](https://blog.tuebora.com/)
- [Documentation](https://tuebora.com/resources/docs)
#### Customers
- [Our Customers](https://tuebora.com/customers/our-customers)
- [Customer Portal](https://support.tuebora.com/hc/en-us)
#### Company
- [About](https://tuebora.com/company/about)
- [Leadership](https://tuebora.com/company/leadership)
- [Careers](https://tuebora.com/company/careers)
- [Life at Tuebora](https://tuebora.com/company/life)
- [Contact](https://tuebora.com/company/contact)
- [Our Partners](https://tuebora.com/partners/our-partners)
- [Partner Program](https://tuebora.com/partners/partner-program)
#### Editions
- [Editions](https://tuebora.com/pricing)
© 2026 Tuebora. All rights reserved.
[Docs](https://tuebora.com/resources/docs) [Privacy](https://tuebora.com/privacy)