The password itself is nearly worthless. The account behind it might control something worth millions.
Colonial Pipeline paid approximately $4.4 million in Bitcoin after a ransomware attack forced the shutdown of its pipeline. The attack began with a compromised VPN credential.
In May 2021, the DarkSide ransomware group broke into Colonial Pipeline's IT network using a compromised employee VPN account. The account was no longer in active use, yet it remained capable of authenticating. Worse, the legacy VPN access did not require multi-factor authentication.
Attackers used legitimate credentials to access a legacy VPN account.
The account was still active despite no longer being used, and the VPN did not require MFA.
DarkSide encrypted Colonial's IT systems and stole data, creating pressure to restore operations.
Colonial halted pipeline operations as a containment measure. Service was restored six days later.
The compromised password associated with the VPN account had appeared in a leaked credential collection. Investigators could not establish with certainty exactly how the attackers obtained the credential. The account also lacked MFA.
A weak password is not necessarily expensive because someone values the password. It is expensive because of what happens after the password works.
A username and password become the attacker's foothold.
The account provides access to systems never intended to be reached by an outsider.
Critical business systems stop working. Operations slow, freeze, or shut down.
Ransom, recovery, lost revenue, investigation and downstream disruption start adding up.
The password doesn't have to be worth $4.4 million. It only has to open the door to something that is.
Nothing about this lesson requires an exotic password-cracking technique. A credential can be exposed somewhere else, reused by an employee, left attached to a forgotten account, and protected by nothing more than a password.
Colonial Pipeline's case demonstrates how quickly a seemingly ordinary authentication failure can become a critical-infrastructure incident. The company supplies a substantial share of the fuel consumed on the U.S. East Coast, and the shutdown triggered shortages, panic buying and price spikes.
123456 is memorable because it is predictable.
That is precisely the problem.
Use a unique password for every important service. Prefer a password manager. And where MFA is available, turn it on.