[News](/news) Colonial Pipeline Hackers Announce Early Retirement [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Colonial Pipeline Hackers Announce Early Retirement ##### [Edward Kost](/team/edward-kost) May 16, 2021 The Colonial Pipeline story has taken an unexpected plot twist after Darkside announced the cessation of their criminal operations. Darkside is the Russian criminal group responsible for the [Colonial Pipeline cyberattack](https://www.upguard.com/news/colonial-pipeline-ransomware-attack) that shut down fuel supply to the U.S east coast. The reason for this sudden change of heart was Darkside’s lost access to its ransomware infrastructure and a mysterious theft from their bitcoin wallet. Darkside operated a [Ransomware-as-a-Service operation](https://www.upguard.com/blog/what-is-ransomware-as-a-service), where they offered their ransomware to affiliates and earned a percentage of each successful ransom payment. Darkside notified its affiliate network of their sudden decision via a post on their website. The announcement explained that a public portion of the criminal group’s ransomware infrastructure was seized by an unspecified law enforcement agency. The following assets were also seized: * The group’s name-and-shame blog * The group’s ransom payment collection website * The group’s Content Delivery Network (CDN). Darkside also said that just a few hours prior to their announcement, an unauthorized transfer of funds occurred from their cryptocurrency wallet linked to ransomware payments from victims It’s unknown whether the exfiltration of Darkside’s funds or the damage to their website was caused by a United States retaliation campaign. Usually websites seized by U.S. law enforcements are branded with a notice by the F.B.I, Darkside’s website is currently just inaccessible. ‍ > As we previously reported, Colonial Pipeline initiated the restart of pipeline operations at approximately 5 p.m. ET on Wednesday, May 12. Since that time, we have returned the system to normal operations, delivering millions of gallons per hour to the markets we serve. [pic.twitter.com/UJG7SqUxSQ](https://t.co/UJG7SqUxSQ) > > — Colonial Pipeline (@Colpipe) [May 15, 2021](https://twitter.com/Colpipe/status/1393529174598504454?ref_src=twsrc%5Etfw) While fuel delivery operations have finally returned to normal, Colonial Pipeline is still has a lot of cleaning up to do, as evidenced by the error message replacing their website at the time of writing this. ‍ But a clean-up operation may involve much more than just re-connecting a website.   IFM Investors, an Australian investment management company, owns a 16% stake in Colonial Pipeline. The company is also owned by 27 Australian union-and-employer-backed industry super funds which links a swathe of the Australian superannuation sector to the Colonial Pipeline incident. Other victims may also surface in the coming weeks since the cyberattacks on service providers tend to impact [multiple entities connected through shared data resources.\ ](https://www.upguard.com/blog/supply-chain-attack#:~:text=A%20supply%20chain%20attack%20is,vendors%20with%20poor%20security%20practices.\&text=When%20a%20vendor%20is%20compromised,pool%20of%20data%20is%20breached.) While Darkside’s liquidation is a happy ending to this tumultuous story, it may not last. After a defeat, cybercriminal groups often resurface under different names and a new reputation. The problem of ransomware attacks will not be solved by hoping criminal groups disappear. The onus is on organizations to [strengthen their security posture](https://www.upguard.com/demo). ## How secure is Colonial Pipeline? Colonial Pipeline operates a refined petroleum products pipeline system that transports gasoline, diesel fuel, jet fuel, and home heating oil from the Gulf Coast to markets in the southeastern and eastern United States. The company provides transportation services for major oil companies and distributors. * View our free preliminary report on Colonial Pipeline’s security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View Colonial Pipeline's score](/security-report/colonial-pipeline) [View score](/security-report/colonial-pipeline) [https://www.colpipe.com/](/security-report/colonial-pipeline) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## Latest news Stay up-to-date with the latest news in cybersecurity. [](/news/hugging-face-data-breach-2026-07-20) #### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 20, 2026 [](/news/ey-data-breach-2026-07-19) #### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) #### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/park-west-psychology-data-breach-2026-07-16) #### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) #### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [](#) July 14, 2026 [](/news/npcil-data-breach-2026-07-16) #### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 14, 2026 [View all news](/news) ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)