Colombian energy giant Ecopetrol says thousands of user accounts were affected by a cyberattack

Ecopetrol confirms ransomware attempt in which attackers stole data from 3,300 user accounts but did not implement the encryption due to security controls
The stolen files were pseudonymous, with no user identities or credentials compromised; Transactional systems and partner networks were not affected.
The company expelled the attackers, began an investigation and notified Colombian authorities; No details of the ransom demand or data leaks have emerged so far.

Latin American energy producer Ecopetrol has revealed that it was the victim of a ransomware attack and while the threat actors managed to get away with sensitive data from thousands of user accounts, they were unable to implement encryption and thus disrupt the company’s daily operations.

In a statement shared with the public, Ecopetrol explained how an unidentified threat actor accessed its IT infrastructure and extracted data from 3,300 user accounts. The attacker then proceeded to install an encryptor, but was stopped by the company’s security controls.

Despite not implementing encryption, the threat actor approached the company demanding payment. We don’t know how much money they asked for in exchange for not sharing the stolen files. The database has apparently not yet been leaked and no one has claimed responsibility for the intrusion. At the same time, Ecopetrol says the stolen files are pseudonymous, suggesting they might not be particularly useful to attackers:

Notify the authorities

“The identity of the users of the 3,300 accounts that were illegally infiltrated was not affected, nor were the users’ respective access credentials captured,” the automatically translated announcement reads. “Ecopetrol SA confirms that no compromises have been identified in the transactional technological solutions of its digital ecosystem, those of its subsidiaries, nor those of its network of commercial, financial allies, suppliers and clients.”

Ecopetrol said it managed to expel the attackers and stop further data leaks. It also launched an internal investigation and notified relevant authorities, including the Colombian Attorney General’s Office, the Joint Cyber Command of the Military Forces, and others.

The investigation is ongoing.

Ecopetrol is Colombia’s state-owned oil and gas giant. It runs production, refining, transportation and exploration operations, and is present in several countries, including Chile, Peru and Bolivia. Its annual revenues are around $30 billion.

Through cyber news