Overview
- Ecopetrol detected unauthorized access to cloud file storage and stopped an attempted ransomware encryption before it could run.
- The intruder downloaded data tied to about 3,300 user accounts across roughly 15 subsidiaries and then issued extortion demands to publish the files.
- The company revoked the compromised access, blocked mass-download methods, analyzed attacker tactics, and increased monitoring under critical-alert protocols.
- Ecopetrol has filed a criminal complaint with Colombia’s Attorney General and is working with national authorities, insurers and capital-markets advisers.
- As of the report, the company has found no material disruption to operations but continues a detailed review of the stolen data and warns it cannot rule out future financial or reputational harm.