Last month’s pipeline shutdown started with hackers taking advantage of an unused but still active VPN account at Colonial Pipeline.