Skip to content
Subscriber Only

Hackers Breached Colonial Pipeline Using Compromised Password

  • Investigators suspect hackers got password from dark web leak
  • Colonial CEO hopes U.S. goes after criminal hackers abroad
Colonial Pipeline Hack
Photographer: Samuel Corum/Bloomberg

The hack that took down the largest fuel pipeline in the U.S. and led to shortages across the East Coast was the result of a single compromised password, according to a cybersecurity consultant who responded to the attack.

Hackers gained entry into the networks of Colonial Pipeline Co. on April 29 through a virtual private network account, which allowed employees to remotely access the company’s computer network, said Charles Carmakal, senior vice president at cybersecurity firm Mandiant, part of FireEye Inc., in an interview. The account was no longer in use at the time of the attack but could still be used to access Colonial’s network, he said.