What happened
- At a Senate Homeland Security and Governmental Affairs Committee hearing on June 8, 2021, CEO Joseph Blount testified about the ransomware attack.
- He said the entry point was a legacy VPN account with single-factor authentication and a compromised password.
- He said: "It was a complicated password".
- He described the VPN as "was a legacy VPN we could not see, and it did not show up in any testing".
- Colonial paid $4.3M to DarkSide.
Root cause, per the sources
Per CEO testimony, a compromised password on a legacy VPN account protected only by single-factor authentication. Password reuse was reported by Mandiant via press (reported, not independently verified).
The exposure behind it
Remote-access systems that are reachable from the internet and protected by a password alone depend entirely on that password. A system nobody inventoried is also one nobody reviews.
What PixelPrivate can check
External scan
It checks public hosts for exposed files and a short fixed list of common admin-panel paths, reported as low-confidence indicators. It cannot find VPN or remote-desktop services.
Learn moreMicrosoft 365 connector (new)New
It can show MFA gaps for Microsoft 365 accounts, such as "Administrators without MFA".
Learn moreWhat PixelPrivate cannot do
- PixelPrivate does not detect intrusions, fraud or active attacks. It performs passive external checks and reports exposures.
- We cannot see whether MFA is enabled on a VPN. The connector covers Microsoft 365 accounts only.
- We do not say that MFA would have prevented this incident, and we do not make that claim.
What to do this week
- List every way into your network from the internet, including old VPNs.
- Turn off remote-access accounts and systems nobody uses.
- Require MFA on remote access and on every administrator account.
- Ask your IT provider for a written list of remote-access systems.
Sources
- US Senate Homeland Security and Governmental Affairs Committee, “Portman presses President and CEO of Colonial Pipeline on gaps in cybersecurity practices”, June 8, 2021. https://www.hsgac.senate.gov/media/reps/portman-presses-president-and-ceo-of-colonial-pipeline-on-gaps-in-cybersecurity-practices/
- BankInfoSecurity, “Colonial CEO at Senate hearing details ransomware attack”, June 2021. https://www.bankinfosecurity.com/colonial-ceo-at-senate-hearing-details-ransomware-attack-a-16836
Last reviewed 2026-10-06. Figures are quoted as reported by the cited source.
Related hypothetical scenarios
Questions about this incident
Would MFA have prevented this?
We do not say that. We report only what the CEO testified: the entry point was a legacy VPN account with single-factor authentication and a compromised password.
Was the password reused?
Password reuse was reported by Mandiant via press. It is reported, not independently verified.
Can PixelPrivate check VPN MFA?
No. It cannot see MFA on a VPN. The Microsoft 365 connector shows MFA gaps for Microsoft 365 accounts.
