Incident BriefingsColonial Pipeline security incident

Colonial Pipeline security incident

DarkSide carried out a ransomware attack against Colonial Pipeline. Colonial Pipeline paid a ransom, and the U.S. Department of Justice later recaptured the majority of that payment.

Last modified

Summary

  • Environment: Energy/Pipeline
  • Operational impact: Colonial Pipeline paid a ransom, and the U.S. Department of Justice later recaptured the majority of that payment.
  • Financial impact: No financial figure is established by the reviewed source evidence
  • Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.

What happened

In 2021, Colonial Pipeline experienced an incident in its energy/pipeline environment. The retained source describes the attack path as follows: DarkSide carried out a ransomware attack against Colonial Pipeline. [1]

The documented consequence was: Colonial Pipeline paid a ransom, and the U.S. Department of Justice later recaptured the majority of that payment. [1]

Impact

  • Documented impact: Colonial Pipeline paid a ransom, and the U.S. Department of Justice later recaptured the majority of that payment. [1]
  • No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.

Timeline

  1. Documented public update

    The DAG Monaco Delivers Remarks at Press Conference on DarkSide Attack on Colonial Pipeline records the incident facts used in this briefing.

    [1]

  2. Briefing updated

    This briefing was last reviewed and updated on September 19, 2026.

Threat Group & Attack Vector

The retained source describes the attack path as follows: DarkSide carried out a ransomware attack against Colonial Pipeline. The canonical record does not add intrusion steps beyond those supported by the source. [1]

Actors

  • DarkSide — identified in the supported attack description. [1]

TTPs

Response

Colonial Pipeline quickly notified law enforcement, enabling the FBI and Justice Department to trace and seize cryptocurrency ransom proceeds. [1]

This account is bounded to DAG Monaco Delivers Remarks at Press Conference on DarkSide Attack on Colonial Pipeline. Details absent from that evidence are left unresolved rather than inferred. [1]