how it happened
- whoDarkSideleaked password
- the gapdormant VPN accountno MFA
- thenIT systemsransomware
- the resultpipeline shut 6 days~$4.4M ransom
what everyone assumed
Accounts nobody uses feel harmless, which is why they survive cleanups. The reasoning is that an attacker needs an active target, and a forgotten login is a target nobody is even using. Disabling it never reaches the top of anyone’s week.
what happened
The unused profile required a password and nothing more. An operator with the leaked credential logged in the ordinary way, found a network with no second lock on this door, and moved from there to the systems that move fuel. Nothing was exploited; something was simply entered.
step by step
- an unused VPN profile still worksIt needs a password and nothing more.the assumption breaks here
- a leaked password opens itThe operator logs in the ordinary way.
- ransomware reaches the systems around fuelNothing is exploited; something is simply entered.
- 7 May 2021the pipeline shuts for about six daysThe East Coast queues for gasoline; a ransom near $4.4M is paid.
how it surfaced
On 7 May 2021 the largest fuel pipeline in the US shut down for roughly six days, and the East Coast queued for gasoline. A ransom near $4.4M was paid. The cause was one dormant VPN account with no MFA.
To an attacker a dormant account is a live credential with a leaked password and nobody watching, which is the easiest kind of door there is.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersThat password shows up in a breach dump and someone tries it.what it costs youThey log in like anyone else, and from there they can shut down the work that actually earns money.
- or it goes like thisit happenedCash App / Block, 2022howThe person logs back in from home, weeks after leaving.what leavescustomer lists and reportswho ends up with itthe former employee and whoever they work for next
- or it goes like thisit happenedCloudflare, 2023howA key or token set up for old work keeps working after everyone forgets it.what leavesinternal systems and documentswho ends up with itwhoever tries the key first
sources
your turn
what you can do about it
this week
Run the query for enabled accounts nobody has used in a year.
Your directory holds accounts nobody has used in a year, each still able to authenticate. One of their passwords is probably in a breach dump already. The list of enabled-but-unused logins is a query you can run this week, and Colonial is what the unrun version cost.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →