Last month’s pipeline shutdown started with hackers taking advantage of an unused but still active VPN account at Colonial Pipeline.

Source: Engadget – Colonial Pipeline ransomware attack linked to a single VPN login