Ecopetrol Continues to Implement Monitoring and Protection Measures in Response to Cybersecurity Incident

Rhea-AI Summary

Ecopetrol (NYSE: EC) reported on July 20, 2026 that updated analyses of its recently disclosed cybersecurity incident indicate the impact was limited to the downloading of files. According to Ecopetrol, no compromise to information integrity has been identified, despite attempts by an external threat actor to destroy, delete, or encrypt data.

The company stated that identities and access credentials of users linked to the 3,300 unlawfully infiltrated accounts were not compromised, and no compromise has been detected in transactional technology solutions of Ecopetrol, its subsidiaries, or its commercial and financial partners, suppliers, and customers. Containment efforts are in an advanced phase, focused on classifying downloaded information, managing extortion demands and threats reported to authorities, and collaborating with national cybersecurity and law enforcement agencies. Ecopetrol affirmed that operational activities of the company and its business group continue without interruption while monitoring and response actions remain ongoing.

Positive

• Impact limited to file downloads; no information integrity compromise identified
• 3,300 infiltrated accounts reported with no user identities or credentials compromised
• No compromise detected in transactional technology solutions of Ecopetrol, subsidiaries, or partners
• Cybersecurity containment efforts in an advanced phase with defined priority actions
• Operational activities and business group continue without interruption
• Active collaboration with multiple Colombian cyber and law enforcement agencies

Negative

• Cybersecurity incident involved unlawful infiltration of 3,300 user accounts
• Incident resulted in unauthorized downloading of files from company systems
• Presence of extortion demands and threats based on unlawfully obtained information
• Containment and monitoring efforts remain ongoing, indicating incident not fully closed

News Market Reaction – EC

+3.12%

2 alerts

+3.12% Session close to close

$33.08B Market Cap

0.3x Rel. Volume

In the Jul 21 session, EC gained 3.12%, reflecting a moderate positive market reaction. Our momentum scanner triggered 2 alerts that day, indicating moderate trading interest and price volatility.

Data tracked by StockTitan Argus on the day of publication.

Market Context

-0.76% was EC’s 24-hour reaction after the S&P rating affirmation in the historical record. That com...

Analysis

-0.76% was EC’s 24-hour reaction after the S&P rating affirmation in the historical record. That comparison shows prior news responses varied; ongoing monitoring and the extortion assessment remain key risks to watch.

Key Figures

Incident date: July 20, 2026 Prior disclosure date: July 17, 2026 Infiltrated accounts: 3,300 accounts +3 more

6 metrics

Incident date July 20, 2026 Cybersecurity incident update

Prior disclosure date July 17, 2026 Earlier cybersecurity incident disclosure

Infiltrated accounts 3,300 accounts Accounts unlawfully infiltrated

Employees More than 19,000 employees Company description

Hydrocarbon production share More than 60% Colombian hydrocarbon production

ISA ownership 51.4% Stake acquired in ISA

Historical Context

5 past events · Latest: Jul 16 (Positive)

Pattern 5 events

Date	Event	Sentiment	24h Move	Catalyst
Jul 16	CVM appeal decision	Positive	-1.1%	Favorable appeal ruling accompanied by a negative 24-hour price reaction.
Jul 15	2Q26 results scheduling	Neutral	-1.1%	Results and conference dates were announced, followed by a negative 24-hour reaction.
Jul 01	FEPC payment	Positive	+1.5%	Government payment of FEPC receivable was followed by a positive 24-hour reaction.
Jun 17	Credit rating affirmation	Positive	-0.8%	Stable BB- affirmation and liquidity support preceded a negative 24-hour reaction.
Jun 15	Labor agreement	Positive	-5.4%	Six-year agreement with unions was followed by a sharply negative 24-hour reaction.

24h Move is the share-price change in the day after each event; other market factors may also have contributed.

Pattern Detected

Positive developments were followed by mixed reactions, with three of four positive historical events diverging from the announcement sentiment.

Key Terms

critical national infrastructure, forward-looking statements

2 terms

critical national infrastructure regulatory

"given Ecopetrol's designation as critical national infrastructure"

Critical national infrastructure are the physical and digital systems, assets and networks—such as power grids, water supplies, transport, telecommunications, financial systems and health services—that a country depends on to function and to protect public safety. For investors it matters because these assets attract special regulation, security requirements and potential government support or intervention, which can affect risk, contracts, timelines and valuations; think of them as the backbone of a nation’s economy.

forward-looking statements financial

"statements that may be considered forward-looking statements"

Forward-looking statements are predictions or plans that companies share about what they expect to happen in the future, like estimating sales or profits. They matter because they help investors understand a company's outlook, but since they are based on guesses and assumptions, they can sometimes be wrong.

AI-generated analysis. How Rhea-AI works. Not financial advice.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

BOGOTÁ, Colombia, July 20, 2026 /PRNewswire/ -- Ecopetrol S.A. (BVC: ECOPETROL; NYSE: EC) reports that the latest analyses conducted regarding the cybersecurity incident and its effects, previously disclosed on July 17, indicate that the impact was limited exclusively to the downloading of files. Accordingly, no compromise to the integrity of the information has been identified, despite the external threat actor's attempts to destroy, delete, and/or encrypt data. The identities of users associated with the 3,300 accounts that were unlawfully infiltrated were not compromised, nor were any user access credentials captured.

Ecopetrol S.A. also confirms that no compromise has been identified in the transactional technology solutions within its digital ecosystem, those of its subsidiaries, or those of its network of commercial and financial partners, suppliers, and customers.

The Company and its subsidiaries continue to carry out containment efforts, now in an advanced phase, prioritizing the following actions:

• Classification of the information downloaded as a result of the incident.
• Assessment and management of extortion demands and threats based on information unlawfully obtained by the external threat actor, which have been reported to the relevant authorities.
• Ongoing collaboration with Colombia's Cyber Emergency Response Team (ColCERT), given Ecopetrol's designation as critical national infrastructure; the Specialized Directorate for Cybercrime of the Office of the Attorney General; the Joint Cyber Command of the Colombian Armed Forces (CCOCI); and the Cybercrime Center of the National Police's Criminal Investigation Directorate (DIJIN).

The operational activities of the Company and its Business Group continue without interruption, while efforts to monitor and address the cybersecurity incident remain ongoing.

Ecopetrol is the largest company in Colombia and one of the main integrated energy companies in the American continent, with more than 19,000 employees. In Colombia, it is responsible for more than 60% of the hydrocarbon production of most transportation, logistics, and hydrocarbon refining systems, and it holds leading positions in the petrochemicals and gas distribution segments. With the acquisition of 51.4% of ISA's shares, the company participates in energy transmission, the management of real-time systems (XM), and the Barranquilla - Cartagena coastal highway concession. At the international level, Ecopetrol has a stake in strategic basins in the American continent, with Drilling and Exploration operations in the United States (Permian basin and the Gulf of Mexico), Brazil, and Mexico, and, through ISA and its subsidiaries, Ecopetrol holds leading positions in the power transmission business in Brazil, Chile, Peru, and Bolivia, road concessions in Chile, and the telecommunications sector.

This release contains statements that may be considered forward-looking statements within the meaning of Section 27A of the U.S. Securities Act of 1933, as amended, and Section 21E of the U.S. Securities Exchange Act of 1934, as amended. All forward-looking statements, whether made in this release or in future filings or press releases, or orally, address matters that involve risks and uncertainties, including in respect of the Company's prospects for growth and its ongoing access to capital to fund the Company's business plan, among others. Consequently, changes in the following factors, among others, could cause actual results to differ materially from those included in the forward-looking statements: market prices of oil & gas, our exploration, and production activities, market conditions, applicable regulations, the exchange rate, the Company's competitiveness and the performance of Colombia's economy and industry, to mention a few. We do not intend and do not assume any obligation to update these forward-looking statements.

For more information, please contact:

Investor Relations Office
Email: investors@ecopetrol.com.co  

Head of Corporate Communications (Colombia) 
Marcela Ulloa 
Email: marcela.ulloa@ecopetrol.com.co 

View original content to download multimedia:https://www.prnewswire.com/news-releases/ecopetrol-continues-to-implement-monitoring-and-protection-measures-in-response-to-cybersecurity-incident-302830039.html

SOURCE Ecopetrol S.A.

FAQ

What did Ecopetrol (NYSE: EC) disclose about the July 2026 cybersecurity incident?

Ecopetrol disclosed that the July 2026 cybersecurity incident was limited to file downloads, with no identified compromise of information integrity. According to Ecopetrol, user identities, access credentials, and transactional technology solutions of the company, its subsidiaries, and partners have not shown signs of compromise.

Were Ecopetrol user accounts compromised in the July 2026 cyberattack on EC?

Ecopetrol reported that 3,300 user accounts were unlawfully infiltrated, but associated identities and access credentials were not compromised. According to Ecopetrol, the impact was confined to file downloads, and no evidence has been found of stolen login data or altered transactional systems.

How is Ecopetrol (EC) responding to extortion demands related to the cybersecurity incident?

Ecopetrol is assessing and managing extortion demands and threats linked to unlawfully obtained information and has reported them to relevant authorities. According to Ecopetrol, this response is part of advanced containment efforts alongside information classification and coordination with Colombia’s cyber and law enforcement agencies.

Did the Ecopetrol cybersecurity incident affect operations or transactional systems in July 2026?

Ecopetrol stated that operational activities of the company and its business group continue without interruption. According to Ecopetrol, no compromise has been identified in transactional technology solutions across its digital ecosystem, subsidiaries, or networks of commercial, financial, supplier, and customer partners.

Which authorities are supporting Ecopetrol (EC) in handling the July 2026 cyber incident?

Ecopetrol is collaborating with ColCERT, the Attorney General’s cybercrime directorate, the Joint Cyber Command, and the National Police cybercrime center. According to Ecopetrol, this coordination supports containment, investigation, and management of threats arising from the cybersecurity incident reported in July 2026.

What is the current status of containment efforts for Ecopetrol’s July 2026 cybersecurity breach?

Ecopetrol indicates that containment efforts are in an advanced phase, with priority actions underway. According to Ecopetrol, these actions include classifying downloaded information, handling extortion threats with authorities, and maintaining ongoing monitoring while company operations continue normally across its business group.

Does the July 2026 Ecopetrol (NYSE: EC) cyber incident pose ongoing risks for investors?

Ecopetrol has not reported data integrity or credential compromise but continues incident monitoring and containment. According to Ecopetrol, operational activities remain uninterrupted, yet extortion demands and ongoing response efforts indicate the cybersecurity situation is still being actively managed with national cyber authorities.