Ecopetrol Suffers Cyberattack Exposing Data of 3,300 Users
Event summary
- Unauthorized access to cloud-based file storage environments affected approximately 15 Ecopetrol subsidiaries, resulting in the unauthorized download of data associated with around 3,300 user accounts.
- An attempted ransomware attack was blocked by Ecopetrol's cybersecurity controls, but extortion demands were communicated by the unidentified external actor.
- Ecopetrol has initiated an investigation and deployed multiple measures to prevent public disclosure of the extracted information, including filing a criminal complaint with Colombian authorities.
- As of July 17, 2026, no material disruption to critical operations or financial impact has been identified, but the company cannot guarantee the incident will not have adverse effects on its business.
The big picture
Ecopetrol, as Colombia's largest integrated energy company and a major player in the Americas, faces strategic challenges in balancing cybersecurity with its extensive operations. The incident highlights vulnerabilities in cloud-based systems within the energy sector, particularly for companies with vast subsidiaries and international operations. Effective response and mitigation will be critical to maintaining investor confidence and operational continuity.
What we're watching
- Operational Resilience
- How Ecopetrol's cybersecurity measures will affect its ability to maintain uninterrupted operations across its subsidiaries.
- Regulatory Scrutiny
- Whether the incident will trigger heightened regulatory oversight or additional compliance requirements for Ecopetrol and its subsidiaries.
- Reputational Risk
- The potential long-term impact on Ecopetrol's reputation among investors, partners, and customers following the data breach.