One Year Later: 3 Insights Into the Colonial Pipeline Attack and Gas & Oil Critical Infrastructure

This report recounts the May 2021 Colonial Pipeline ransomware incident attributed to the Russian-speaking DarkSide gang and summarizes Censys's assessment of internet exposure across Colonial and ten other major U.S. pipeline companies: root cause (reused VPN password and missing MFA), Censys findings of numerous internet-exposed hosts, insecure protocols, and expired certificates, observed improvements at Colonial (reduced exposed logins and outdated software), and an overall increase in attack surface across the peer group that highlights ongoing risk to critical infrastructure.