Ecopetrol Confirms Data Leak After Cyberattack

Ecopetrol confirmed it detected unauthorized access to cloud file storage environments and a ransomware attempt in an incident that affected information tied to nearly 3,300 user accounts across about 15 companies in the group. The company said it had not identified material disruption to critical operations or any impact on its transactional platforms.

What did Ecopetrol report?

Ecopetrol confirmed it detected unauthorized access to cloud file storage environments and a ransomware attempt. According to the company, the incident affected information tied to nearly 3,300 user accounts across about 15 companies in the group.

The company also said the attackers published information that had been copied illegally. Since then, it has been working with the Cybercrime Unit of the Attorney General’s Office and the Ministry of ICT to remove the content and limit access.

What was the scope of the incident?

In its initial statement, Ecopetrol said it had not identified material disruption to its critical operations or any impact on its transactional platforms. It also reported no impact on those of its subsidiaries, business partners, financial institutions, suppliers or customers.

El Espectador reported that the company activated protocols after the illegal disclosure of information and was working with authorities to remove the unlawfully published content. In another report, the outlet said the incident reached 15 companies in the group and that the posted information was being removed or restricted.

How was the attack attributed, and what did the company do?

ICS Strive placed the case on July 17, 2026, and classified it as an attack on critical energy infrastructure in Colombia, with a blocked ransomware attempt but data theft and extortion. A later analysis by LeMagIT attributed the attack to the ransomware-as-a-service group The Gentlemen, an organization that has already claimed more than 250 victims in different countries and operates through data theft extortion without needing to encrypt critical systems.

LeMagIT also said Ecopetrol revoked unauthorized access, blocked mass-download mechanisms and filed a criminal complaint with national authorities. The same report noted that, despite the scale of the incident and the theft of data from roughly 3,300 accounts in cloud environments across about 15 subsidiaries, the oil company said its critical operations had not been interrupted.

What risks is the company still assessing?

According to a cable reproduced by Cong Nghe Va Doi Song, Ecopetrol was still assessing the scope of the compromised data, which could include sensitive security information, proprietary data and personal data. The same material said the company warned investors that it could not guarantee the leak would not have a serious adverse financial effect, and that it also flagged possible significant impacts on its business, reputation and financial condition.

Reuters, cited by that outlet, added that at the time of the official notice Ecopetrol had not yet detected open publication of the stolen data, although it had received extortion demands with threats of disclosure. NIVEL4 Labs, in its weekly bulletin, also highlighted the case as a significant incident of the week and said the malicious actor downloaded information from about 3,000 user accounts, while the company kept its critical functions running.