Ecopetrol Tackles Data Leak from 15 Group Firms After July 2026 Cyberattack
Ecopetrol confirmed that external actors began publishing information illegally obtained from 15 companies of the Ecopetrol Group during a cyberattack that started on 17 July 2026. The breach exposed data linked to roughly 3,300 user accounts and was publicly circulated on 27 July 2026. In response, the oil company activated new security protocols and is working with the Fiscalía General de la Nación and the Ministry of Information Technologies and Communications (MinTIC) to have the leaked material removed from internet platforms.
Ecopetrol warned citizens, organizations and media not to access, download or share the stolen files, noting that such actions could violate Colombian data‑protection and confidentiality laws. The company stressed that its critical IT infrastructure, transactional platforms and services for subsidiaries, suppliers and financial partners remain operational with no reported disruptions. The overall financial impact of the incident is still being assessed.
According to the company’s investigation, the intrusion was carried out by the ransomware‑as‑a‑service group known as “The Gentlemen,” which is responsible for about 10 % of global ransomware attacks, second only to the Qilin network.
Entities: Colombia · Ecopetrol S.A. · Fiscalía General de la Nación · Ministry of Information Technologies and Communications (MinTIC) · The Gentlemen
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [○ 1 SOURCE] The intrusion was attributed to the ransomware‑as‑a‑service group “The Gentlemen.” (97d81063-adda-46fd-b0b5-fcb03c829dab)
- [● 6 SOURCES] Ecopetrol reported its critical IT infrastructure and transactional platforms remain operational with no disruptions. (All articles)
- [● 6 SOURCES] Ecopetrol activated new security protocols and is cooperating with the Fiscalía General de la Nación and MinTIC to remove the leaked content. (All articles)
- [○ 1 SOURCE] The Gentlemen group accounts for about 10 % of global ransomware attacks, second after the Qilin network. (97d81063-adda-46fd-b0b5-fcb03c829dab)
- [○ 1 SOURCE] The cyberattack began on 17 July 2026 and affected about 3,300 user accounts. (68b8079c-1148-4015-9dcd-cd2a95a9ba09)
- [● 6 SOURCES] Ecopetrol warned that accessing, downloading or sharing the leaked data could violate Colombian law. (All articles)
- [● 6 SOURCES] The financial impact of the breach is still being evaluated and has not been quantified. (All articles)
- [● 6 SOURCES] External actors began publishing illegally obtained information from 15 Ecopetrol Group companies during a cyberattack in July 2026. (All articles)