Ecopetrol Hacked

Extortion demands have been made; no operational disruption reported yet

Ecopetrol S.A. (BVC: ECOPETROL; NYSE: EC) disclosed on July 17 that an unidentified external actor gained unauthorized access to digital resources belonging to the company and its subsidiaries, downloading data associated with approximately 3,300 user accounts and then issuing extortion demands.

The unauthorized access affected cloud-based file storage environments at roughly 15 subsidiaries, including Ecopetrol itself. According to the company’s disclosure, the external actor threatened to publicly release the information that had been extracted. A separate ransomware attempt against the group was blocked by cybersecurity controls already deployed across the company and its subsidiaries.

Ecopetrol said it opened an investigation and activated its incident response and management protocols. The measures it described include the immediate revocation of unauthorized access to the compromised digital assets, blocking of the mechanisms tied to mass downloads of information, and identification, analysis and containment of the tactics, techniques and procedures used by the actor.

The company also filed a criminal complaint with the Fiscalía General de la Nación (Office of the Attorney General of Colombia) and began cooperating with specialized national authorities. It said it is working to identify the external infrastructure used to store or download the information in order to pursue restriction or blocking actions, and has activated support mechanisms with insurers and specialized capital markets teams.

Remaining steps disclosed by the company include a detailed assessment of the downloaded information to determine its criticality, and enhanced monitoring of its technology infrastructure under critical alert protocols with continuous validation of preventive and detective controls.

“The Company has not identified any material disruption to its critical operations, production capacity, or essential services.” — Ecopetrol S.A., market disclosure, July 17, 2026

No production or refining impact reported

As of the date of the disclosure, Ecopetrol said it had not identified any material disruption to its critical operations, production capacity or essential services, nor any direct financial impact that would prevent it from continuing to conduct business. It also said it had not identified any public disclosure of the information subject to the unauthorized access.

The company qualified that assessment, stating that it continues to evaluate the potential exposure of corporate information, which could include confidential, restricted, proprietary or personal data. Ecopetrol said it cannot guarantee that the incident will not have a material adverse effect on its business, reputation, operating results or financial condition, and that it will disclose any material developments to the market in accordance with applicable regulations.

Scope of the exposure

The breadth of the affected corporate perimeter is the element investors are likely to watch. Ecopetrol is the largest company in Colombia, with more than 19,000 employees, and is responsible for more than 60% of the country’s hydrocarbon production along with most of its transportation, logistics and refining systems. It also holds leading positions in petrochemicals and gas distribution.

Through its acquisition of 51.4% of the shares of ISA, Ecopetrol participates in power transmission, the management of real-time systems through XM, and the Barranquilla–Cartagena coastal highway concession. Internationally, the company holds stakes in strategic basins across the Americas, with drilling and exploration operations in the United States — in the Permian basin and the Gulf of Mexico — as well as in Brazil and Mexico. Through ISA and its subsidiaries, Ecopetrol holds power transmission positions in Brazil, Chile, Peru and Bolivia, road concessions in Chile, and interests in telecommunications.

Ecopetrol shares trade on the Bolsa de Valores de Colombia and, as American depositary receipts, on the New York Stock Exchange. The company said it will continue to monitor developments and disclose material facts as they are identified. Further disclosures are published through its investor relations channel.