Ecopetrol confirms download of 3,300 accounts’ data

Update August 24, 2026: Ecopetrol expanded the scope of the incident and said it affected cloud storage at approximately 15 companies in the group. It also reported unauthorized downloads of data associated with about 3,300 user accounts.

Ecopetrol said that, based on its latest analysis, the cyberattack only involved the download of company files. The company also ruled out any impact on the identity of the 3,300 accounts or on their login credentials.

Confirmed scope

The update, released by the company, narrows the incident to a file exfiltration. Based on that analysis, Ecopetrol said there is no evidence that the users linked to those 3,300 accounts were affected or that their access data was compromised.

The key point in the statement is that the episode did not lead, according to the company, to any operational impact. That distinction matters because the company’s initial statement aimed to define the technical event before describing any broader business disruption.

What was ruled out

Ecopetrol specified two areas that were not compromised, according to its latest review. First, the identity of the users behind the 3,300 accounts mentioned. Second, the access credentials.

The available information does not add details about the technique used, the origin of the attack, or the type of files downloaded. It also does not include, in the material provided, any public attribution to a possible responsible party. The company limited itself to sharing the results of its analysis and narrowing the scope of the incident.

Coverage from El Espectador and La República matches that same point, while the corporate report published in Yahoo Finance is also among the sources available on the event.