Ecopetrol Data Leak: Hackers Claim 327,095 Files From Colombia’s State Oil Firm
Colombia · Business
Key Facts
- —The claim A ransomware crew called The Gentlemen says it stole 327,095 files, roughly one terabyte, from Ecopetrol and its units.
- —The company line Ecopetrol confirms only an unauthorized download tied to about 3,300 user accounts across some 15 group firms.
- —The timing Ecopetrol disclosed the incident on July 17, 2026, and the hackers claimed responsibility a day later.
- —The response Ecopetrol says it blocked the ransomware encryption, revoked access, and reported the case to Colombia’s Attorney General.
- —The impact The company reports no disruption to oil production, and it says user passwords were not captured.
Colombia’s biggest company confirms a breach of some 3,300 accounts, yet insists no passwords fell and no oil stopped flowing.
The Ecopetrol data leak has become a public standoff between Colombia’s state oil giant and the hackers who hit it. A group calling itself The Gentlemen says it walked off with 327,095 files.
Ecopetrol, however, insists the real breach was far narrower than that.
What the hackers say they took
A ransomware group known as The Gentlemen went public a day after Ecopetrol’s disclosure. It claimed to hold up to one terabyte of company data.
In its telling, that haul spans Ecopetrol itself and a string of subsidiaries. So far, though, those boasts rest on the attackers’ own word, not the company’s.
What Ecopetrol actually confirms
Ecopetrol’s official account is much narrower. It confirms an unauthorized download of data tied to roughly 3,300 user accounts.
Those accounts sat in cloud file storage across about 15 companies in the Ecopetrol group. Beyond that, the firm has not put a total file count or data volume on the record.
Live Company IntelligenceEcopetrol SA ADR — the full investor dossier
Wall Street view
Valuation & profitability
Price & risk
$8.1652-wk high
$17.75
Revenue trend · 6y
Ownership
Dividend
The 327,095-file number, explained
The headline figure of 327,095 files is a hacker claim, not a company confirmation. It surfaced through Colombian media, including a Caracol Radio analysis of the breach.
El País reported the same order of magnitude, describing more than 327,000 files and up to a terabyte. Still, Ecopetrol has not validated any such count.
Inside the Ecopetrol data leak
The Ecopetrol data leak is not just a threat on paper. By late July, an external actor had published material copied from 15 group companies, the firm told regulators.
According to El País, the attackers claim the trove includes drilling records for fields such as Rubiales and Casabe. They also allege it holds payroll, banking, medical and biometric details on staff.
A clash over stolen passwords
The most pointed dispute is over credentials. The Gentlemen say they grabbed active VPN and FortiClient logins, plus password-vault contents.
Ecopetrol flatly denies it. The company says user identities were not exposed and that no access credentials were captured.
How Ecopetrol responded
Ecopetrol says its defenses blocked the encryption phase of the attack before files could be locked. As a result, the ransomware never fully detonated.
The company then revoked the intruder’s access and throttled mass downloads. Meanwhile, it filed a criminal complaint with Colombia’s Attorney General and looped in national cyber agencies.
Was oil production affected?
This is the reassuring part of the story, at least for now. Ecopetrol reports no material disruption to its operations, production capacity or essential services.
Because the breach hit office cloud storage rather than industrial controls, the pumps kept running. In short, this reads as a data theft, not a shutdown of the oil business.
The extortion and the deadline
Ecopetrol confirms the attacker made extortion demands and threatened to publish the stolen files. When those threats were ignored, the data began appearing online.
Caracol Radio, citing prosecutors, reported a blunt ultimatum: behave, or the material goes public in seven days. Even so, no specific ransom amount has been confirmed publicly.
Why this matters for Colombia
Ecopetrol is not just any target. It is Colombia’s largest company and a pillar of the national budget, so an attack on it lands as a public-interest event.
The episode also lands during a tense stretch for the firm’s leadership and regulators. For a foreign reader, it is a reminder that Latin America’s biggest firms now face the same ransomware pressure as Western ones.
What to watch next
The open question is how much of the hackers’ claim proves real. Investigators must still weigh the 327,095-file boast against what Ecopetrol will admit.
The company is working with authorities to pull the leaked material offline. Yet once files reach the dark web, they rarely disappear for good.
Frequently Asked Questions
Who attacked Ecopetrol?
A ransomware group calling itself The Gentlemen claimed responsibility. Ecopetrol officially describes the attacker only as an unidentified external actor.
Is the 327,095-files figure confirmed?
No. It is a claim made by the hackers and relayed by Colombian media. Ecopetrol has confirmed only an unauthorized download tied to about 3,300 accounts.
Did the attack stop Ecopetrol’s oil production?
Ecopetrol says no. It reports no material disruption to operations, production or essential services, because the breach hit cloud file storage rather than industrial systems.
When did this happen?
Ecopetrol disclosed the incident on July 17, 2026. The Gentlemen claimed the attack a day later, and data was published online by late July.
Connected Coverage
Sources: Reuters; El País; TechRadar; Caracol Radio.
This article was produced by The Rio Times’ automated newsroom system. How we use AI · Report an error
Read More from The Rio Times