Colombia · Business
Key Facts
—Breach scope. Approximately 3,300 user accounts across 15 Ecopetrol Group companies were compromised in the cloud-file storage intrusion.
—Extortion threat. An unidentified external actor demanded payment and threatened to publish the stolen data, though no leak has yet been confirmed.
—Operational status. Ecopetrol reports no material disruption to critical operations or production, and the ransomware execution was blocked.









