Get alerts on this situation

We’ll email you as it develops, and you can follow the whole thread from day one.

Unsubscribe anytime.

[SITUATION] · [ACTIVE]

2 clusters · 21 sources · 11 days · First seen 12 days ago · Last updated 1 day ago

Ecopetrol cyberattack data breach

Entities: Ministry of Information Technologies and Communications (MinTIC) · Fiscalía General de la Nación · Colombia · The Gentlemen · Ecopetrol S.A.

Overview

State‑controlled Colombian oil firm Ecopetrol disclosed a cyberattack on 17 July 2026 that compromised cloud‑based storage used by its 15 subsidiaries, exposing data linked to roughly 3,300 user accounts. The attackers made extortion demands and attempted ransomware infection, but production and core operations were not disrupted.

A week later the company confirmed that the stolen information had begun to be published online. It warned the public against accessing or sharing the material and noted that the breach was being investigated with the Fiscalía General de la Nación and the Ministry of Information Technologies and Communications. The intrusion was attributed to the ransomware‑as‑a‑service group known as “The Gentlemen,” responsible for about 10 % of global ransomware attacks. Ecopetrol activated additional security protocols and is working to remove the leaked data from internet platforms while assessing the financial impact.

Claims

What the coverage asserts, and how well corroborated each claim is across sources.

[● 6 SOURCES] External actors began publishing illegally obtained information from 15 Ecopetrol Group companies during a cyberattack in July 2026. (All articles)
[● 6 SOURCES] Ecopetrol activated new security protocols and is cooperating with the Fiscalía General de la Nación and MinTIC to remove the leaked content. (All articles)
[● 6 SOURCES] Ecopetrol warned that accessing, downloading or sharing the leaked data could violate Colombian law. (All articles)
[● 6 SOURCES] Ecopetrol reported its critical IT infrastructure and transactional platforms remain operational with no disruptions. (All articles)
[● 6 SOURCES] The financial impact of the breach is still being evaluated and has not been quantified. (All articles)
[○ 1 SOURCE] The cyberattack began on 17 July 2026 and affected about 3,300 user accounts. (68b8079c-1148-4015-9dcd-cd2a95a9ba09)
[○ 1 SOURCE] The intrusion was attributed to the ransomware‑as‑a‑service group “The Gentlemen.” (97d81063-adda-46fd-b0b5-fcb03c829dab)
[○ 1 SOURCE] The Gentlemen group accounts for about 10 % of global ransomware attacks, second after the Qilin network. (97d81063-adda-46fd-b0b5-fcb03c829dab)

Timeline

1 day ago

[TECHNOLOGY] 6 sources
Ecopetrol Tackles Data Leak from 15 Group Firms After July 2026 Cyberattack
Ecopetrol says a July 2026 cyberattack leaked data from 15 group firms; it has activated security measures, is working with Colombian authorities to remove the content, and reports no IT service disruptions.
12 days ago

[TECHNOLOGY] 18 sources
Colombia's Ecopetrol reports cyberattack affecting 3,300 accounts
Ecopetrol disclosed a cyberattack that stole data from about 3,300 accounts across 15 subsidiaries, triggered extortion threats, but caused no operational disruption yet.

Sources

diariodelcauca.com.co · diariodelsur.com.co · elespectador.com · elnuevosiglo.com.co · elperiodicodeportivo.com.co · extra.com.co · hsbnoticias.com · kagonma-info.com · kelo.com · kfgo.com · laopinion.com.co · larazon.co · notiulti.com · nxt.kristianstadsbladet.se · srnnews.com · stocktitan.net · vocero.com.mx · wdez.com · wkzo.com · wtvbam.com · wxerfm.com