The password that shut down a pipeline
Colonial’s CEO says attackers used an old VPN account with no MFA. One leaked password was enough.
Last week Colonial Pipeline’s CEO told the US Senate how the attackers got in: a legacy VPN account that was no longer in use but still active, protected by a password and no MFA. The password was found in a batch of leaked credentials.
That’s it. No zero-day. An old account and a reused password.
Three things to do this week:
- List every account that can use your VPN and remote access. Disable the ones nobody owns or hasn’t used for 90 days.
- Require MFA for all remote access, no exceptions for “legacy” or “temporary”.
- Check your domains in breach data, and reset passwords that appear there.
Attackers don’t need your strongest door. They need the one you forgot.