Ecopetrol faces extortion following major data breach

The unauthorized access affected systems across 15 subsidiaries of the Colombian oil company. In response, Ecopetrol has revoked the attackers' access, filed a criminal complaint with the Office of the Attorney General, and initiated a forensic assessment to determine the criticality of the stolen files. The company is also coordinating with insurers and cybersecurity specialists to contain the fallout.

Despite the breach, Ecopetrol reports that its core operations, production capacity, and essential services remain functional. Management cautioned that it cannot yet rule out long-term material adverse effects on the company’s reputation or financial condition. The investigation remains ongoing as the firm works to identify the external infrastructure used by the perpetrators to host the sensitive data.