Ecopetrol: Colombian energy giant Ecopetrol says thousands of user accounts hit in cyberattack

Ecopetrol Thwarts Ransomware Attack, Prevents Data Encryption but Loses Pseudonymous Files

Colombia’s state-owned energy giant, Ecopetrol, disclosed a ransomware attack in which threat actors exfiltrated data from 3,300 user accounts but failed to deploy encryption due to the company’s security controls. The incident, detected and contained by Ecopetrol, did not disrupt transactional systems, partner networks, or compromise user identities or credentials.

The unidentified attackers accessed Ecopetrol’s IT infrastructure and extracted pseudonymous files data stripped of direct identifiers before attempting to deploy ransomware. While the company’s defenses blocked the encryption phase, the threat actors still issued a ransom demand, though no payment details or public data leaks have emerged. No group has claimed responsibility for the intrusion.

Ecopetrol responded by ejecting the attackers, halting further data exfiltration, and launching an internal investigation. Colombian authorities, including the Attorney General’s Office and the Joint Cyber Command of the Military Forces, were notified. The probe remains ongoing.

With operations spanning oil and gas production, refining, and transportation across Colombia, Chile, Peru, and Bolivia, Ecopetrol generates roughly $30 billion in annual revenue. Despite the breach, the company confirmed no impact on its digital ecosystem, subsidiaries, or third-party networks.

Source: https://www.techradar.com/pro/security/colombian-energy-giant-ecopetrol-says-thousands-of-user-accounts-hit-in-cyberattack

Ecopetrol TPRM report: https://www.rankiteo.com/company/ecopetrol

"id": "eco1784557630",
"linkid": "ecopetrol",
"type": "Ransomware",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': '3,300 user accounts',
                        'industry': 'Oil and gas',
                        'location': 'Colombia, Chile, Peru, Bolivia',
                        'name': 'Ecopetrol',
                        'size': 'Annual revenue of ~$30 billion',
                        'type': 'State-owned energy company'}],
 'data_breach': {'data_encryption': 'Attempted but blocked',
                 'data_exfiltration': 'Yes',
                 'number_of_records_exposed': '3,300 user accounts',
                 'personally_identifiable_information': 'No',
                 'sensitivity_of_data': 'Stripped of direct identifiers',
                 'type_of_data_compromised': 'Pseudonymous files'},
 'description': 'Colombia’s state-owned energy giant, Ecopetrol, disclosed a '
                'ransomware attack in which threat actors exfiltrated data '
                'from 3,300 user accounts but failed to deploy encryption due '
                'to the company’s security controls. The incident did not '
                'disrupt transactional systems, partner networks, or '
                'compromise user identities or credentials.',
 'impact': {'data_compromised': 'Pseudonymous files from 3,300 user accounts',
            'identity_theft_risk': 'No compromise of user identities or '
                                   'credentials',
            'operational_impact': 'No disruption to transactional systems, '
                                  'partner networks, or digital ecosystem'},
 'investigation_status': 'Ongoing',
 'ransomware': {'data_encryption': 'Attempted but blocked',
                'data_exfiltration': 'Yes',
                'ransom_demanded': 'Yes'},
 'regulatory_compliance': {'regulatory_notifications': 'Colombian authorities '
                                                       'notified'},
 'response': {'containment_measures': 'Ejected attackers, halted further data '
                                      'exfiltration',
              'incident_response_plan_activated': 'Yes',
              'law_enforcement_notified': 'Attorney General’s Office, Joint '
                                          'Cyber Command of the Military '
                                          'Forces'},
 'title': 'Ecopetrol Thwarts Ransomware Attack, Prevents Data Encryption but '
          'Loses Pseudonymous Files',
 'type': 'Ransomware'}