Colombian state-owned energy giant Ecopetrol announced Friday that a cyberattack resulted in the theft of data connected to approximately 3,300 user accounts. The company also acknowledged it cannot “guarantee” the breach will not have a “material adverse” financial impact.
Despite the alarming disclosure, Ecopetrol said that as of Friday, no critical disruptions to its operations or production capacity had been detected, and no direct financial damage had been confirmed. Additionally, the hacker has not yet publicly released any of the stolen information.
Ecopetrol ranks among Latin America’s largest energy producers and is Colombia’s biggest company overall, responsible for more than 60% of the nation’s hydrocarbon output.
While the identity of the attacker remains unknown, the hacker has reached out to the company with extortion demands and has threatened to make the compromised data public if those demands are not met.
The breach impacted cloud-based file storage systems across 15 subsidiaries, including Ecopetrol itself. The company added that it successfully blocked a separate ransomware attack attempt during the incident.
Ecopetrol said it is still evaluating the full scope of the breach, which may involve confidential, proprietary, or personal data. The company cautioned that the incident could ultimately affect its business operations, reputation, financial results, or overall financial standing.
