Colombia's state oil giant Ecopetrol says cyberattack stole data tied to 3,300 accounts

On 17 July 2026, Ecopetrol — the state-controlled oil and gas company that produces more than 60% of Colombia's hydrocarbons — disclosed that it had suffered a cyberattack in which intruders gained unauthorized access to its digital resources and stole data. According to the company, the intrusion reached cloud-based file-storage systems used across 15 of its subsidiaries, and the attackers made off with information tied to roughly 3,300 accounts.

Ecopetrol said that, alongside the data theft, an unidentified attacker also attempted a ransomware attack, which the company's security controls blocked before it could encrypt systems. The attacker subsequently issued extortion demands, threatening to publicly release the stolen data. As of the disclosure, none of the data had surfaced publicly, and Ecopetrol had not identified the attacker nor said whether it would consider paying.

A contained breach at critical infrastructure

Crucially, Ecopetrol reported no disruption to its operations or oil production as a result of the incident. The attack appears to have been confined to file-storage repositories rather than the industrial control systems that run the company's refineries and pipelines, which limited the physical blast radius. Even so, the breach raised fresh questions about the cybersecurity posture of one of Latin America's largest energy producers — a strategically important, state-controlled firm whose output underpins a substantial share of Colombia's national economy.

Open questions

At the time of disclosure, several details remained unconfirmed. Ecopetrol did not attribute the attack to any known threat actor or ransomware group, did not specify exactly what categories of data were tied to the 3,300 affected accounts, and did not quantify any financial impact. With the ransomware attempt blocked, the intrusion contained, and no operational disruption reported, the incident's status was best characterised as contained — though the extortion threat remained live and the full scope of the stolen data was still under assessment.