CoChat
Sign Up
Cited by 1Information and Cyber SecurityCybersecurity and Cyber Warfare StudiesCybercrime and Law Enforcement Studies

Colonial Pipeline: Responding to a Ransomware Attack in the Energy Sector

Open access
Janvrin, Diane J., Boss, Scott R., Gray, Joy·2026·Issues in Accounting Education
DOI 10.2308/issues-2025-014
Open this paper in CoChat — free accountOpen PDF

Abstract

ABSTRACT Surveys suggest that almost half of recent cyberattacks have involved ransomware. This case concerns the May 2021 cyberattack on Colonial Pipeline, a private company within the U.S. critical energy infrastructure, and reveals a web of vulnerabilities in the company’s cybersecurity controls. Prompted by a ransom note demanding 75 bitcoins ($4.4 million), Colonial Pipeline shut down its pipelines and called in a cybersecurity consultant to investigate. The attackers, identified as the DarkSide group, exploited a reused password leaked in a prior data breach and gained access to an inactive employee account on a virtual private network lacking two-factor authentication. This ransomware incident underscores the imperative for implementing robust cybersecurity measures, including enhanced user authorization management and multifactor authentication (MFA), in an ever-evolving cyber threat landscape. This case critically examines the Colonial Pipeline cyberattack and offers insights into how to mitigate cyber threats and respond to ransomware demands for organizations worldwide.

Verified 2026-10-11 · 13 references not checked yet

AI snapshot

Written from the paper’s full text.

TL;DR

This teaching case examines the May 2021 ransomware attack on Colonial Pipeline, tracing how attackers used a leaked password on an inactive VPN account without multifactor authentication to breach the company, prompting a five-day pipeline shutdown and a $4.4 million ransom payment. It is designed for accounting courses and reports pilot evidence that students found the case effective for learning ransomware and cybersecurity concepts.

Key findings

  • The ransom note demanded 75 bitcoins (roughly $4.4 million at the time); CEO Joseph Blount paid within 48 hours of discovery, citing the time needed to assess damage amid worsening fuel-supply disruption.
  • The intrusion exploited an inactive account on a legacy VPN that lacked multifactor authentication, using a password previously exposed on the Dark Web in an unrelated breach; the DarkSide group, operating a ransomware-as-a-service model, was identified as responsible.
  • Colonial shut down its pipelines as a precaution on May 7 and reopened them May 12; the FBI later seized 63.7 bitcoins, worth $2.3 million after a drop in bitcoin's value.
  • Student efficacy ratings (n = 124, seven-point scale) averaged 5.90–6.51 across nine items, with all comparisons against a neutral mean significant at the 0.001 level.

Methods

  • Instructional case design: a narrative account of the Colonial Pipeline incident, followed by five case requirements and extension questions, with learning objectives mapped to AICPA and IMA competency frameworks.
  • Data drawn from public sources including news reports, government documents, and company statements; the case also compares disclosures by MGM Resorts and Clorox after their own ransomware incidents.
  • Efficacy testing: pilot in spring 2024 with 20 students, then a revised version in fall 2024 at three institutions (n = 30, 86, and 8), using qualitative and quantitative student feedback analyzed with univariate and median testing.

Limitations

  • The authors note that institution 3 (n = 8) produced significantly higher responses than institutions 1 and 2 on several items, attributing this to the small sample and stating it does not discredit the results.
  • The paper states that Colonial Pipeline management declined to disclose specifics of its ransomware-related insurance coverage, that negotiation details remain undisclosed, and that the extent of the company's risk assessment procedures is unknown.
  • Evident from the text: the case is pedagogical rather than an empirical study of the attack, and its efficacy evidence rests on self-reported student perceptions from a non-random convenience sample.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.2308/issues-2025-014

Cites

5 of 20 references verified0 citation errors · 2 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 44 cited sources checked · 0 supported · 0 flagged

  • Findingown data

    Generally, the 20 students gave positive informal feedback about the case.

    “Generally, the 20 students gave positive informal feedback about the case.”
    Quote in the paperNot a substantial claim
  • Findingreasoning

    The ransomware attack inflicted on Colonial Pipeline in 2021 had ramifications for its business practices as well as for consumers.

    “The ransomware attack inflicted on Colonial Pipeline in 2021 had ramifications for its business practices as well as for consumers”
    Quote in the paperSubstantial claim
  • Findingown data

    The results of comparing means and medians against a neutral mean were all statistically significant at <0.001 levels.

    “The results of comparing means and medians against a neutral mean were all statistically significant at <0.001 levels.”
    Quote in the paperSubstantial claim
  • Findingown data

    In all cases the responses from institution 3 were significantly higher than the results for institutions 1 and 2.

    “Further review of these results indicated that in all cases the responses from institution 3 were significantly higher than the results for institutions 1 and 2”
    Quote in the paperNot a substantial claim
  • Findingown data

    Additional analysis of the results for differences between the respondents at the different institutions did find significant differences between institution 3 and institutions 1 and 2 on questions 1, 2, 3, 6, 7, 8, and 9.

    “Additional analysis of the results for differences between the respondents at the different institutions did find significant differences between institution 3 and institutions 1 and 2 on questions 1, 2, 3, 6, 7, 8, and 9.”
    Quote in the paperNot a substantial claim
  • Classified as probably not a substantial claim. 42
  • May combine two claims. 17
  • The quote only partly states this claim. 1

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    The Colonial Pipeline attack stoked fears of a fuel shortage reminiscent of the energy crisis of the 1970s.

    “and stoked fears of a fuel shortage reminiscent of the energy crisis of the 1970s.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    The Colonial Pipeline attack affected 50 million Americans.

    “The Colonial Pipeline attack affected 50 million Americans”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data

    Students reported that they spent approximately one hour finalizing their answers.

    “Students reported that they spent approximately one hour finalizing their answers.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data

    The question generated an interesting discussion.

    “They reported that the question generated an interesting discussion”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data

    During case efficacy, two nonauthors asked their students about whether the ransom payment should have been made, even if it was legal.

    “In addition, we note that during case efficacy, two nonauthors asked their students about whether the ransom payment should have been made, even if it was legal.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data

    The students expressed mixed opinions on whether the ransom should have been paid.

    “and that the students expressed mixed opinions on whether the ransom should have been paid.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    The DarkSide attackers exploited a reused password leaked in a prior data breach and gained access to an inactive employee account on a virtual private network lacking two-factor authentication.

    “The attackers, identified as the DarkSide group, exploited a reused password leaked in a prior data breach and gained access to an inactive employee account on a virtual private network lacking two-factor authentication.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites Culafi 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Turton and Mehrotra 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Classified as probably not a substantial claim.

    Study design and conductnone given

    We pilot-tested the case in spring 2024 in a combined senior undergraduate and graduate course on advanced accounting information systems.

    “We pilot-tested the case in spring 2024 in a combined senior undergraduate and graduate course on advanced accounting information systems.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    The ransomware attack inflicted on Colonial Pipeline in 2021 motivated the changes to the SEC's cybersecurity reporting requirements.

    “and motivated the changes to the SEC's cybersecurity reporting requirements.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductnone given

    The case is designed for a course on cybersecurity in accounting, accounting information systems, fraud examination, or advanced auditing.

    “This case is designed for a course on cybersecurity in accounting, accounting information systems, fraud examination, or advanced auditing.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    Some ransomware variants use double extortion, where the fraudster encrypts data and threatens to leak sensitive data if the ransom demanded is not paid.

    “Some variants use double extortion, where the fraudster encrypts data and threatens to leak sensitive data if the ransom demanded is not paid.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Colonial Pipeline had $3.1 billion of assets, $2.6 billion of long-term debt, and generated net income of $420 million on $1.3 billion of revenues.

    “Helman (2021) reported that Colonial Pipeline had”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Helman 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationreasoning

    The case of Colonial Pipeline illustrates the public's dependency on utility companies and, by extension, the regulatory agencies that oversee them.

    “The case of Colonial Pipeline illustrates the public's dependency on utility companies and, by extension, the regulatory agencies that oversee them.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    Cybersecurity risks have increased for companies that the public depends on, such as utility services, which are components of U.S. critical infrastructure.

    “Cybersecurity risks have increased for companies that the public depends on, such as utility services, which are components of U.S. critical infrastructure.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    These differences do not discredit the results.

    “We believe that these differences do not discredit the results.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisereasoning

    The business and community impact of the ransomware attack on Colonial Pipeline was significant, with pipelines shut down, extra monitoring required, and temporary shortages of fuel for consumers and businesses.

    “The business and community impact of the ransomware attack on Colonial Pipeline, an energy sector company, was significant, with pipelines shut down, extra monitoring required, and temporary shortages of fuel for consumers and businesses.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Ransomware attacks now account for almost half of all cyberattacks.

    “Ransomware attacks now account for almost half of all cyberattacks”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Help Net Security 2024

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationcitation

    Exposing accounting students to ransomware concepts and examples of real-world incidents helps prepare them to be successful professionals.

    “so exposing accounting students to ransomware concepts and examples of real-world incidents helps prepare them to be successful professionals”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Help Net Security 2024

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    DarkSide deploys ransomware and uses double-extortion tactics, encrypting data using Salsa20 and RSA encryption.

    “DarkSide deploys ransomware and utilizes double-extortion tactics, whereby it encrypts data using Salsa20 and Rivest-Shamir-Adleman (RSA) encryption”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites Constantin 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Osborne 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The SEC recently added a rule requiring all publicly traded companies to disclose cybersecurity risk management and incidents.

    “In addition, the U.S. Securities and Exchange Commission (SEC) (U.S. Securities and Exchange Commission (SEC) 2023) recently added a rule requiring all publicly traded companies to disclose cybersecurity risk management and incidents.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites U.S. Securities and Exchange Commission (SEC) 2023

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    DarkSide operates a ransomware-as-a-service model and collaborates with cybercriminals who deploy its ransomware.

    “Active since 2020, DarkSide operates a ransomware-as-a-service (RaaS) model 1 and collaborates with cybercriminals who deploy its ransomware.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites Kerner 2024

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Osborne 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationnone given

    The case of Colonial Pipeline provides students with an opportunity to learn how a company responded to a ransomware attack in the critical energy sector and apply cybersecurity concepts to a real-world scenario.

    “The case of Colonial Pipeline provides students with an opportunity to learn how a company responded to a ransomware attack in the critical energy sector and apply cybersecurity concepts to a real-world scenario.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    DarkSide used similar tactics to breach CompuCom, Discount Car and Truck Rentals, Toshiba Tec, and Brenntag.

    “DarkSide used similar tactics to breach CompuCom, Discount Car and Truck Rentals, Toshiba Tec, and Brenntag (Abrams 2021;Novinson 2021;Osborne 2021;Shead 2021), as shown in Table 1.”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites Abrams 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Novinson 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Osborne 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisenone given

    DarkSide implemented a double-extortion style of attack against Colonial Pipeline, a type of attack that is increasing in frequency.

    “DarkSide implemented a double-extortion style of attack against Colonial Pipeline, a type of attack that is increasing in frequency.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Interpretationreasoning

    Had better controls been in place at the time of the attack, the damage to Colonial Pipeline's operations and its customers might have been reduced.

    “However, had better controls been in place at the time of the attack, the damage to Colonial Pipeline's operations and its customers might have been reduced.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: Adequate risk management procedures had not been implemented at Colonial Pipeline.
    • Rests on an assumption: Colonial Pipeline did not have a Chief Information Security Officer or an incident response plan.

  • May combine two claims.

    Premisenone given

    Existing cases address cybersecurity issues in general, but apart from a management-focused case by Srinivasan and Ni (2023), the authors are not aware of any current cases that address the increasing trend of ransomware.

    “Although existing cases address cybersecurity issues in general (Bakarich and Baranek 2020;Boss et al. 2022;Boss, Gray, and Janvrin 2024), we are not aware of any current cases apart from a management-focused case by Srinivasan and Ni (2023) that addresses the increasing trend of ransomware.”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites Bakarich and Baranek 2020 source
    • cites Boss et al. 2022 source
    • cites Srinivasan and Ni 2023

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    FBI agents monitored transfers of the 75-bitcoin ransom and seized a portion of the cryptocurrency paid to the attackers.

    “Over the next 19 days, FBI agents monitored transfers of the 75-bitcoin ransom to digital addresses on a publicly visible bitcoin ledger.On May 27, one transfer of nearly 64 bitcoins led to a virtual address accessible by the FBI.This allowed agents to obtain a warrant and seize a portion of the cryptocurrency paid to the attackers (Uberti 2021).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Uberti 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    Ransomware attacks have a large financial and operational impact on their victims, both in terms of the ransom payment and the unavailability of critical information systems.

    “Ransomware attacks have a large financial and operational impact on their victims, both in terms of the ransom payment and the unavailability of critical information systems.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    A recent report from Malwarebytes shows a 63 percent increase in ransomware attacks in the United States between July 2023 and June 2024.

    “A recent report from cybersecurity firm Malwarebytes shows rapid growth in ransomware, with a 63 percent increase in ransomware attacks in the United States between July 2023 and June 2024 (Cozens 2024).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Cozens 2024

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationnone given

    Colonial Pipeline's prompt and adequate disclosures and public updates on the progress of the attack provided transparency to its stakeholders.

    “On the positive side, Colonial Pipeline's prompt and adequate disclosures and public updates on the progress of the attack provided transparency to its stakeholders: customers, investors, and government agencies.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    In double extortion, payment does not ensure that the data will be recovered or withheld from release, particularly if payment is delayed or intercepted, or the attacker acts in bad faith.

    “Thus, although this tactic increases the pressure on victims to comply, payment does not ensure that the data will be recovered or withheld from release-particularly if the payment is delayed or intercepted, or the attacker acts in bad faith.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    Fuel prices rose and gas shortages prompted panic-buying during the five-day shutdown.

    “Fuel prices shot up as lines at the pump grew longer over the five-day shutdown.Gas shortages prompted residents of affected areas to”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Wood 2023

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    As part of the critical energy sector, pipeline companies must follow Federal Energy Regulatory Commission (FERC) regulations.

    “As part of the critical energy sector, pipeline companies must follow Federal Energy Regulatory Commission (FERC) regulations.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Interpretationcitation

    The Colonial Pipeline case expands the discussion of cybersecurity issues into the topical purview of environmental, social, and governance courses by examining a real-world ransomware involving the lack of appropriate governance in a critical energy sector company.

    “The Colonial Pipeline case expands the discussion of cybersecurity issues into the topical purview of environmental, social, and governance courses, an important development in the accounting profession today (Bakarich, Baranek, and O'Brien 2023;McGowan 2023) by examining a real-world ransomware involving the lack of appropriate governance in a critical energy sector company.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites Bakarich, Baranek, and O'Brien 2023 source
    • cites McGowan 2023

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given

    Ransomware attacks have grown in complexity and frequency over the past few years.

    “Ransomware attacks have grown in complexity and frequency over the past few years.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Study design and conductown data

    The revised version of the case was tested in fall 2024 at three separate institutions: a small private institution on the East Coast (institution 1, n = 30), a large public institution in the Midwest (institution 2, n = 86), and a large public institution in the West (institution 3, n = 8).

    “Based on their feedback, we revised the case and tested the revised version in fall 2024 at three separate institutions: a small private institution on the East Coast (institution 1, n ¼ 30), a large public institution in the Midwest (institution 2, n ¼ 86), and a large public institution in the West (institution 3, n ¼ 8).”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Ransomware attacks raise questions about the reliability of financial reporting data and result in significant financial and reputational harm to companies that fall victim to them.

    “Ransomware attacks raise questions about the reliability of financial reporting data, and they result in significant financial and reputational harm to companies that fall victim to them (August, Dao, and Niculescu 2022).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites August, Dao, and Niculescu 2022 source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductreasoning

    The case requirements can be matched to the learning objectives.

    “The case requirements can be matched to the learning objectives.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    As of 2021, TSA had not established any regulations that directly concerned cybersecurity and depended on industry compliance with voluntary guidelines.

    “As of 2021, TSA had not established any regulations that directly concerned cybersecurity.Instead, TSA depended on industry compliance with voluntary guidelines (Parfomak and Jaikaran 2021).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Parfomak and Jaikaran 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given

    Colonial Pipeline's decision to pay the ransom is not outside the norm, and for companies without adequate controls in place, this option may be the most appealing one.

    “In summary, Colonial Pipeline's decision to pay the ransom is not outside the norm, and for companies without adequate controls in place, this option may be the most appealing one.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: Adequate risk management procedures had not been implemented at Colonial Pipeline.

  • Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

    Interpretationreasoning

    The attack underscored the need for companies to perform regular cyber risk assessments and to implement appropriate risk management strategies, including having cybersecurity staff.

    “The attack underscored the need for companies to perform regular cyber risk assessments and to implement appropriate risk management strategies, including having cybersecurity staff.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    DarkSide used Cobalt Strike to gain access to CompuCom's network.

    “In another cyberattack, DarkSide used a well-known tool, Cobalt Strike, to gain access to CompuCom's network.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Novinson 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    A ransom payment may not protect the company from litigation, as evidenced by Caesars Entertainment.

    “We note that a ransom payment may not protect the company from litigation, as evidenced by Caesars Entertainment.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Caesars Entertainment

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Brenntag paid $4.4 million in bitcoins.

    “Brenntag paid $4.4 million in bitcoins (Abrams 2021).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Abrams 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing). The quote only partly states this claim.

    Study design and conductcitation

    The learning objectives relate to the AICPA and IMA competency frameworks.

    “The learning objectives cover several items from the Core Competency Framework of the AICPA (American Institute of Certified Public Accountants (AICPA) 2018).”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites American Institute of Certified Public Accountants (AICPA) 2018

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Institute of Management Accountants 2019

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationcitation

    CompuCom's security measures were weaker than Colonial Pipeline's.

    “suggesting that CompuCom's security measures were weaker than Colonial Pipeline's (Novinson 2021).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Novinson 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationreasoning

    Publicly traded companies may be more financially vulnerable or exposed due to mandatory disclosure requirements compared to private companies.

    “We recommend that instructors remind students that publicly traded companies may be more financially vulnerable or exposed due to mandatory disclosure requirements compared to private companies.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationreasoning

    This attack showed that no company is immune.

    “This attack showed that no company is immune”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    On April 28, 2021, DarkSide attacked Brenntag by stealing credentials that lacked two-factor authentication, locked company data, and issued a demand for ransom.

    “For example, on April 28, 2021, DarkSide attacked Brenntag by stealing credentials that lacked two-factor authentication, locked company data, and issued a demand for ransom.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Abrams 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Cobalt Strike is used to test system defenses.

    “Cobalt Strike is used to test system defenses”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Novinson 2021

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Study design and conductnone given

    We followed procedures of the Human Subjects Review Board at the institutions where participant data were obtained.

    “We followed procedures of the Human Subjects Review Board at the institutions where participant data were obtained.”
    Quote in the paperNot a substantial claim
51 of 51

  • The authors state this as an assumption.

    Adequate risk management procedures had not been implemented at Colonial Pipeline.

    “Although the extent of Colonial Pipeline's risk assessment procedures is unknown, one can assume that adequate risk management procedures had not been implemented.”

  • The authors state this as an assumption.

    Colonial Pipeline had standard software protection measures in place given its $40 million investment in cybersecurity.

    “Colonial Pipeline presumably had standard software protection measures in place, given its $40 million investment in cybersecurity”

  • The paper relies on this without support.

    Colonial Pipeline did not have a Chief Information Security Officer or an incident response plan.

    “but not having a CISO or incident response plan may be viewed as serious concerns.”
3 of 3

Cites

  • Economics of ransomware: Risk interdependence and large-scale attacks

    August, T., Dao, D., & Niculescu, M. F. (2022) · Management Science · doi:10.1287/mnsc.2022.4300 · Cited by 37 · see citing works

  • The current state and future implications of environmental, social, and governance assurance

    Bakarich, K. M., Baranek, D., & O’Brien, P. E. (2023) · Current Issues in Auditing · doi:10.2308/ciia-2022-012 · Cited by 27 · see citing works

  • Accountants, cybersecurity isn’t just for “techies”: Incorporating cybersecurity into the accounting curriculum

    Boss, S. R., Gray, J., & Janvrin, D. J. (2022) · Issues in Accounting Education · doi:10.2308/issues-2021-001 · Cited by 17 · see citing works

    Self-citation

  • Evidence on going concern reporting before and after ASU 2014–15

    Bakarich, K., & Baranek, D. (2020) · Accounting Research Journal · doi:10.1108/arj-06-2020-0165 · Cited by 4 · see citing works

  • Be an Expert: A Critical Thinking Approach to Responding to High-Profile Cybersecurity Breaches

    Boss, S. R., Gray, J., & Janvrin, D. J. (2023) · Issues in Accounting Education · doi:10.2308/issues-2021-094 · Cited by 3 · see citing works

    Self-citation

  • Abrams, L. 2021. Chemical distributor pays $4.4 million to DarkSide ransomware. https://www.bleepingcomputer.com/news/security/chemical-distributor-pays-44-million-to-darkside-ransomware

    (n.d.)

    Unresolved

  • American Institute of Certified Public Accountants (AICPA). 2018. AICPA pre-certification core competency framework. https://assets.ctfassets.net/rb9cdnjh59cm/7yHf1nrFONahxltbDdwg9J/89e5fee10ebfdf74190aea1859732d70/sas-128.pdf

    (n.d.)

    Unresolved

  • American Institute of Certified Public Accountants (AICPA). 2023. AICPA unveils blueprints for redesigned CPA exam. https://www.aicpa-cima.com/news/article/aicpa-unveils-blueprints-for-redesigned-cpa-exam

    (n.d.)

    Unresolved

  • American Institute of Certified Public Accountants (AICPA). 2025. Code of professional conduct. https://www.aicpa-cima.com/topic/ethics/code-of-professional-conduct

    (n.d.)

    Unresolved

  • Baker, K. 2023. What is ransomware as a service (RaaS)?—CrowdStrike. CrowdStrike 2023. https://www.crowdstrike.com/cybersecurity-101/ransomware/ransomware-as-a-service-raas/

    (n.d.)

    Unresolved

  • ESG in the accounting curriculum

    Brands (2022) · Strategic Finance

    Unresolved

  • CloudFlare. 2024. What is ransomware? Ransomware meaning. https://www.cloudflare.com/learning/security/ransomware/what-is-ransomware/

    (n.d.)

    Unresolved

  • Help Net Security. 2024. Ransomware fallout: 94% experience downtime, 40% face work stoppage. Available from https://www.helpnetsecurity.com/2024/05/23/ransomware-attacks-data-exfiltration/

    (n.d.)

    Unresolved

  • Cybersecurity topical requirement.

    Institute of Internal Auditors (2024)

    Unresolved

  • Institute of Management Accountants. 2019. IMA management accounting competency framework. https://www.imanet.org/research-publications/statements-on-management-accounting/ima-management-accounting-competency-framework

    (n.d.)

    Unresolved

  • McGowan, J. 2023. The SEC may be overstepping its authority in ESG/climate related disclosure standards. https://www.forbes.com/sites/jonmcgowan/2023/08/30/the-sec-may-be-overstepping-its-authority-in-esg-climate-related-disclosure-standards/

    (n.d.)

    Unresolved

  • Novinson, M. 2021. CompuCom malware attack expected to cost company $20M. https://www.crn.com/news/security/compucom-malware-attack-expected-to-cost-company-20m

    (n.d.)

    Unresolved

  • Ransomware Attack at Colonial Pipeline Company

    Srinivasan (2023)

    Unresolved

  • SEC adopts rules on cybersecurity risk management, strategy, governance, and incident disclosure by public companies

    U.S. Securities and Exchange Commission (SEC) (2023)

    Unresolved

  • SEC charges four companies with misleading cybers disclosures

    U.S. Securities and Exchange Commission (SEC) (2024)

    Unresolved

Flagged first, then by citations

15 of the 20 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Related

Authors
Janvrin, D. J., Boss, S. R., & Gray, J.
Affiliations
  • Iowa State University (US)
  • Bentley University (US)
  • Arizona State University (US)
ORCID
Venue
Issues in Accounting Education
Publisher
American Accounting Association
Published
2026-04-06
Volume
41
Issue
2
Pages
131-145
ISSN
  • 0739-3172 (ISSN-L)
  • 1558-7983
DOI
10.2308/issues-2025-014
OpenAlex
W7118177010
Cited by
1
References
20
Citations by year
2026: 1
FWCI
8.51
Type
journal article
Language
en
Open access
Locations
Issues in Accounting Education (publishedVersion)
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Social Sciences › Political Science and International Relations › Cybersecurity and Cyber Warfare Studies
  • Physical Sciences › Computer Science › Information Systems › Cybercrime and Law Enforcement Studies
Keywords
ransomware, critical infrastructure cybersecurity, energy sector, password reuse, data breaches, two-factor authentication, multi-factor authentication, incident response, virtual private networks, cyberattack mitigation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-11.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-11.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review