Ecopetrol Confirms Data Breach Limited to File Exfiltration

The company clarified that its transactional technology solutions, including those utilized by subsidiaries and external financial partners, were not affected by the intrusion. While the external threat actor attempted to disrupt data operations, the firm’s core business functions have continued without interruption. The breach is currently under review as the company works to classify the specific information accessed during the incident.

Ecopetrol is now managing extortion threats stemming from the stolen data, having formally reported these demands to the Attorney General’s Office. The firm is coordinating its response with the Colombian Armed Forces’ Joint Cyber Command, the National Police’s cybercrime division, and ColCERT. As a critical piece of national infrastructure, Ecopetrol remains in an advanced stage of containment, prioritizing the security of its broader energy network while maintaining full hydrocarbon production and logistics operations.