Ecopetrol Data Breach Hits 3,300 Accounts After Cyberattack

Ecopetrol, Colombia’s largest company and one of Latin America’s biggest energy producers, said Friday that a cyberattack stole data tied to roughly 3,300 user accounts, and that it cannot rule out a “material adverse” financial hit from the breach.

The breach hit cloud-based file storage systems across 15 subsidiaries, including Ecopetrol itself. An unidentified attacker also attempted a ransomware attack, which the company’s security controls blocked. The hacker has since made extortion demands and threatened to publicly release the stolen data, though none had surfaced as of Friday.

Ecopetrol said it has found no disruption to operations or production so far, but the incident raises fresh questions about cybersecurity at a state-controlled firm that produces more than 60% of Colombia’s hydrocarbons.

What Ecopetrol Disclosed

In a statement filed Friday, Ecopetrol SA said it identified unauthorized access to digital resources belonging to the company and its subsidiaries by an external actor that has not been identified. The company said it also detected and blocked an attempted ransomware attack targeting the same systems.

The unauthorized access affected cloud-based file storage environments across approximately 15 subsidiaries, resulting in the download of data tied to about 3,300 user accounts, according to the company’s disclosure.

Ecopetrol said it has activated its incident response protocols and launched an investigation. The company said it would disclose further material information as required by law if the situation develops.

Extortion Threat

The attacker communicated extortion demands to Ecopetrol and threatened to publicly release the data taken in the breach, the company said. As of Friday, no stolen data had been leaked publicly, according to Reuters.

Ecopetrol said it could not guarantee the breach would not have a “material adverse” financial impact, though it added that it had not identified any critical disruption to its operations, production capacity, or direct financial results as of Friday.

Why It Matters

Ecopetrol is Colombia’s largest company and among the largest integrated energy firms in the Americas, employing more than 19,000 people. It accounts for more than 60% of the country’s hydrocarbon production and holds leading positions in petrochemicals and gas distribution. Through its majority stake in ISA, Ecopetrol is also tied to energy transmission and grid operations in the region, including Colombia’s real-time grid management system.

The company is listed on both the Colombian Stock Exchange and the New York Stock Exchange, meaning a confirmed financial or operational impact could carry consequences beyond Colombia’s borders.

Ecopetrol has not identified the attacker and has not said whether it will pay the extortion demand. The company said it will continue monitoring the situation and disclose additional material facts as required under applicable securities law.