Cyberattack on Colombian Company Ecopetrol Exposes 3,300 Accounts
Ecopetrol, Colombia’s largest company and one of Latin America’s leading oil producers, confirmed that it was the victim of a cyberattack that allowed an external actor to gain unauthorized access to part of its digital infrastructure and extract information linked to approximately 3,300 user accounts.
The incident also affected technological environments used by approximately 15 companies within the Ecopetrol Group, raising concerns about the scope of the intrusion and the extortion threats that would stem from the criminal action.
Although the oil company stated that its operations, production capacity, and essential services continue to function normally, it acknowledged that those responsible for the attack have already made extortion demands and threatened to publicly disclose the information obtained.
The company announced that it activated its response protocols, launched an investigation, and filed a complaint with Colombia’s Attorney General’s Office regarding the incident.
Cyberattack on Colombian company Ecopetrol exposes 3,300 accounts
The incident was detected after monitoring systems identified unauthorized access to digital resources belonging to the company. According to Ecopetrol in a statement, the attackers also attempted to carry out a ransomware attack, a form of data hostage-taking that seeks to block or encrypt files in order to demand payment in exchange for their recovery.
The company stated that the attempt was neutralized thanks to cybersecurity controls implemented across the business group, preventing the criminals from encrypting critical systems.
However, the attackers did succeed in downloading information stored on cloud-based file platforms used by approximately 15 companies within the group, resulting in the exposure of data associated with about 3,300 user accounts.
After obtaining the information, those responsible for the attack contacted the company to demand money in exchange for not publishing the stolen data. Ecopetrol did not disclose the amount demanded or confirm the exact type of information compromised, but acknowledged that it continues to assess the content of the downloaded files to determine their level of criticality.
The oil company warned that the compromised information could include confidential data, restricted information, proprietary documents, and even personal data, although that assessment is still ongoing. It also stated that, for now, there is no evidence that the stolen material has been publicly disclosed.
#InformaciónRelevante | Ecopetrol informa sobre un incidente cibernético. Lee más aquí 👇 pic.twitter.com/l7Pkog1QqH
— Ecopetrol (@ECOPETROL_SA) July 18, 2026
Ecopetrol’s Response
After detecting the intrusion, the company launched a broad containment protocol. Among its first actions was the immediate revocation of unauthorized access and the blocking of mechanisms related to the mass downloading of information.
At the same time, it began analyzing the techniques used by the attackers in order to strengthen protection measures and limit any new access attempts. The company also began identifying external servers and infrastructure that may have been used to store or download the extracted information, with the aim of requesting restrictions or shutdowns whenever possible.
Ecopetrol also reported that it is working in coordination with national authorities specializing in cybercrime, as well as with insurers and technology risk management experts, to determine the true impact of the incident.
Despite the seriousness of the attack, the company stated that, so far, it has not identified any material disruptions to its critical operations, hydrocarbon production, or the provision of essential services. It has also not reported any direct financial impacts resulting from the incident.
However, the company acknowledged that it is still impossible to rule out future consequences for its business. The potential publication of confidential information could generate reputational, commercial, or even financial impacts, depending on the content ultimately compromised and how those responsible for the attack use it.
The case remains under investigation as cybersecurity specialists and authorities seek to identify those responsible for the intrusion and determine the true scope of the data breach.
Ecopetrol stated that it will maintain permanent monitoring of its systems and will inform the market if, during the course of the investigation, any material developments are identified that must be disclosed.
The incident once again highlights the growing threat posed by cyberattacks against strategic companies and the importance of strengthening the protection of digital infrastructures considered critical to the Colombian economy.
