Colombia's Ecopetrol says cyberattack stole data from 3,300 accounts

Ecopetrol said hackers stole data tied to about 3,300 user accounts after breaching digital resources at Colombia’s state-controlled oil company. The attack matters well beyond the stolen accounts because Ecopetrol sits at the center of the country’s energy system, where customer records, business files and operational networks can all become national-security risks.

In its July 17 disclosure, Ecopetrol said an external actor it had not identified gained unauthorized access to certain digital resources owned by the company and its subsidiaries. The company said the intrusion affected cloud-based file storage environments at roughly 15 subsidiaries, and that an attempted ransomware attack was blocked by its cybersecurity controls.

Ecopetrol also warned that it could not guarantee the incident would not have a material adverse financial impact. Reuters Legal highlighted that language on social media, underscoring the possibility of remediation costs, legal exposure and reputational damage even if core production systems were not visibly disrupted. The company’s statement focused on account-linked information and cloud storage rather than physical assets such as wells, refineries or transport infrastructure.

That distinction matters for an enterprise like Ecopetrol, which spans oil and gas production, refining, transport and related services. A breach involving 3,300 accounts suggests attackers were able to reach a meaningful slice of the company’s digital footprint, and possibly the records of customers, employees or contractors. For energy companies, the same systems that store commercial data can also become entry points into wider corporate networks, a problem that has helped make the sector a persistent target for ransomware and credential theft.

The incident adds to a broader cyber-risk picture in Colombia. Reuters reported in September 2023 that more than 50 Colombian state entities and private companies were hit by a cyberattack, a reminder that the country’s public and private sectors have already faced large-scale digital intrusions. With Ecopetrol, the concern is especially sharp because cyber incidents at a state-linked energy company can ripple through government finances, investor confidence and public trust in critical infrastructure.