Ecopetrol Confirms Data Theft and Extortion After Cyberattack
Summary
Ecopetrol confirmed unauthorized access and data extraction affecting about 3,300 user accounts across roughly 15 group companies. It said a ransomware attempt was blocked; the actor demanded payment, but no public disclosure of the stolen data has been confirmed.
Key points
- Ecopetrol confirmed an external actor gained unauthorized access to company digital resources; the actor has not been identified.
- Cloud file-storage environments at about 15 Ecopetrol group companies were affected, with data linked to roughly 3,300 user accounts downloaded.
- The actor allegedly demanded payment to prevent public disclosure of the extracted information; the amount and data types were not disclosed.
- Ecopetrol said a ransomware attempt was blocked by its cybersecurity controls.
- The company revoked unauthorized access, blocked mechanisms used for bulk downloads, and began investigating the actor's tactics and the scope of the data exposure.
- Ecopetrol reported no material disruption to critical operations or production, and said it had not confirmed public disclosure of the stolen data.
Article Details
- Victim Organization
- Ecopetrol
- Incident Type
- Confirmed unauthorized access to digital infrastructure and extraction of data associated with user accounts; a ransomware attack was attempted but blocked.
- Data Types Exposed
- Information associated with approximately 3,300 user accounts; specific data types were not disclosed.
- Affected Records
- Approximately 3,300 user accounts
- Operational Impact
- Ecopetrol reported no material interruption to critical operations, production capacity, or essential services, and no identified direct financial impact at the time of reporting. The investigation was ongoing.
- Ransom Or Extortion
- The attacker demanded payment in exchange for not publicly disclosing the extracted data. The amount was not disclosed. The attempted ransomware attack was blocked.
- Claim Status
- confirmed