Ecopetrol Confirms Data Leak After Cyberattack

What Ecopetrol reported

Ecopetrol said it detected unauthorized access to cloud file storage environments and an attempted ransomware attack. According to the company, the incident affected information linked to about 3,300 user accounts across roughly 15 companies in the group.

The company also said the attackers published information that had been copied unlawfully. Since then, it has been working with the Attorney General's Office cybercrime unit and the Ministry of Information and Communications Technologies to take down the content and restrict access.

Scope of the incident

In its initial statement, Ecopetrol said it had not identified material disruptions to its critical operations or any impact on its transactional platforms at that point. It also reported no effects on the systems of its subsidiaries, business partners, financial institutions, suppliers, or customers.

El Espectador reported that the company activated protocols after the unlawful disclosure of information and was working with authorities to remove the illegally posted content. In another report, the outlet said the incident reached 15 companies in the group and that the published information was being removed or restricted.

Attribution and technical response

ICS Strive placed the case on July 17, 2026, and classified it as an attack on critical energy infrastructure in Colombia, with a blocked ransomware attempt but data theft and extortion. A later analysis by LeMagIT attributed the attack to the ransomware-as-a-service group The Gentlemen, an organization that has already claimed more than 250 victims in several countries and operates under a data-theft extortion model without needing to encrypt critical systems.

LeMagIT also said Ecopetrol revoked unauthorized access, blocked mass-download mechanisms, and filed a criminal complaint with national authorities. That same report noted that, despite the scale of the incident and the theft of data from roughly 3,300 accounts in cloud environments tied to about 15 subsidiaries, the oil company maintained that its critical operations had not been interrupted.

Risks the company is still assessing

According to a cable reproduced by Cong Nghe Va Doi Song, Ecopetrol was still assessing the scope of the compromised data, which could include sensitive security information, proprietary data, and personal data. The same material said the company warned investors that it could not guarantee the leak would not have a severe adverse financial impact, and that it also flagged possible significant effects on its business, reputation, and financial condition.

Reuters, as cited by that outlet, added that at the time of the official notice Ecopetrol had not yet detected open publication of the stolen data, although it had received extortion demands with threats of disclosure. NIVEL4 Labs, in its weekly bulletin, also highlighted the case as a notable incident of the week and said the threat actor downloaded information from about 3,000 user accounts, while the company kept its critical functions running.