Public cyber incident analysis · 2021
Colonial Pipeline: containing the incident, managing the shutdown
An attack on IT systems, a precautionary operational shutdown and a staged restart. This case makes the distinction between containment and operational continuity tangible.
Analysis of a public incident, not a CyberUP client reference. Disclosures, documents and operational interpretation.
At a glance
A case timeline, not a recovery benchmark
Restart and deliveries
Funds seized
Valued at about US$2.3 million when seized; not the entire ransom payment. [3]
Figures and dates come from the cited sources. They are not results from a CyberUP exercise.
The documented record
Facts and scope.
What the testimony establishes
Joseph Blount described encryption of the IT network and a precautionary shutdown to prevent possible spread to operational systems. He identified a legacy VPN profile, which was not intended to be in use, as a line of investigation. That account does not establish direct compromise of industrial controls. [1]
Restart, distribution and ransom recovery measure different things
The DOE timeline records the resumption of deliveries; it does not establish that every local consequence had been resolved. On the financial side, the DOJ reported a payment of approximately 75 BTC and the seizure of 63.7 BTC. Dollar valuations at different dates do not provide a directly comparable recovery percentage. [2] [3]
Key dates
The documented timeline.
Who can stop operations, and who can authorise a restart?
The exercise should test how technical evidence informs decisions with physical consequences. We propose a simulation in which the cyber team has incomplete information while Operations must decide whether to maintain, restrict or stop the service. The objective is not to assume that there is always one correct answer, but to make the reasoning behind the decision observable.
The programme should establish who can authorise a precautionary measure and which information must be shared immediately. Updates to leadership and operational functions need to distinguish what is compromised from what has been stopped as a precaution. External communications should preserve the same distinction.
For a return to service, we suggest a set of observable conditions: systems available, checks completed, people ready to operate and dependencies ready to support them. This is not another workflow. It prevents a single approval from being interpreted as confirmation that the entire chain is back to normal.
The exercise must respect the participant’s safety procedures and accountabilities. It allows coordination and decisions to be observed; it neither replaces plant validation nor guarantees continuity of the real process.
From incident analysis to readiness
Three questions to test.
Exercise ideas for your organisation. They do not describe work carried out by CyberUP for the organisation discussed.
Who has authority to order a precautionary shutdown?
Define who decides, who is informed and what rationale is recorded when the incident picture is incomplete.
Does the update distinguish shutdown from compromise?
Prepare an update that separates affected systems, precautionary measures and service consequences, without filling gaps with assumptions.
What conditions authorise a restart?
Agree technical and operational checks, including external dependencies. Identify who confirms each condition.
Source record
Sources and further reading.
Source dates and the period covered are distinct from this page’s source-review date. CyberUP interpretations are labelled as such. External sources do not imply endorsement or a commercial relationship.
- Colonial Pipeline · US Senate · 8 June 2021
Written testimony of Joseph Blount (opens in a new tab)Primary testimony · PDF. PDF pages 1–4: IT systems, precautionary shutdown, restart and the investigation into the VPN profile. - U.S. Department of Energy · May 2021 timeline
Colonial Pipeline Cyber Incident (opens in a new tab)Primary government timeline. Shutdown on 7 May and the 13 May announcement on the system restart and resumption of deliveries. - U.S. Department of Justice · 7 June 2021
Seizure of cryptocurrency linked to the Colonial Pipeline ransom (opens in a new tab)Primary government statement. Approximately 75 BTC paid; 63.7 BTC seized, valued at about US$2.3 million at that time.