Ecopetrol Thwarts Ransomware Attack, Prevents Data Encryption but Loses Pseudonymous Files Colombia’s state-owned energy giant, Ecopetrol, disclosed a ransomware attack in which threat actors exfiltrated data from 3,300 user accounts but failed to deploy encryption due to the company’s security controls. The incident, detected and contained by Ecopetrol, did not disrupt transactional systems, partner networks, or compromise user identities or credentials. The unidentified attackers accessed Ecopetrol’s IT infrastructure and extracted pseudonymous files data stripped of direct identifiers before attempting to deploy ransomware. While the company’s defenses blocked the encryption phase, the threat actors still issued a ransom demand, though no payment details or public data leaks have emerged. No group has claimed responsibility for the intrusion. Ecopetrol responded by ejecting the attackers, halting further data exfiltration, and launching an internal investigation. Colombian authorities, including the Attorney General’s Office and the Joint Cyber Command of the Military Forces, were notified. The probe remains ongoing. With operations spanning oil and gas production, refining, and transportation across Colombia, Chile, Peru, and Bolivia, Ecopetrol generates roughly $30 billion in annual revenue. Despite the breach, the company confirmed no impact on its digital ecosystem, subsidiaries, or third-party networks.

Ecopetrol Confirms Data Breach in Cybersecurity Incident Colombia’s state-owned oil company, Ecopetrol, has reported a data breach following a cybersecurity incident. The breach, disclosed in recent regulatory filings, exposed sensitive information, though the full scope of compromised data remains under investigation. The attack targeted the company’s digital infrastructure, raising concerns about potential operational and financial risks. Ecopetrol, a major player in Latin America’s energy sector, has not yet released details on the attackers’ methods or whether ransomware was involved. Authorities and cybersecurity firms are assisting in the response. The incident highlights growing cyber threats to critical infrastructure, particularly in the energy sector, where high-value targets face increasing attacks. Further updates are expected as the investigation progresses.