Ecopetrol reports major cybersecurity incident

Ecopetrol S.A. reported a cybersecurity incident involving unauthorized access by an unidentified external actor to certain digital resources of the company and its subsidiaries, including cloud-based file storage.

Rhea-AI Filing Summary

Ecopetrol S.A. reported a cybersecurity incident involving unauthorized access by an unidentified external actor to certain digital resources of the company and its subsidiaries, including cloud-based file storage. An attempted ransomware attack was blocked by cybersecurity controls.

The incident affected cloud environments of approximately 15 subsidiaries, including Ecopetrol, and led to the unauthorized download of data linked to about 3,300 user accounts. The external actor issued extortion demands, threatening to disclose the unlawfully extracted information.

Ecopetrol activated incident response and management protocols, revoked unauthorized access, blocked mass-download mechanisms, analyzed the attacker’s tactics, filed a criminal complaint in Colombia, engaged insurers and specialized teams, and enhanced infrastructure monitoring. As of July 17, 2026, it has not identified material disruption to critical operations, production capacity, essential services, or direct financial impacts preventing normal business, nor any public disclosure of the accessed information, but acknowledges the incident could still have a material adverse effect on its business, reputation, results, or financial condition.

Positive

• None.

Negative

• Unauthorized access to cloud-based storage affected approximately 15 subsidiaries and data linked to about 3,300 user accounts, creating potential legal, financial, and reputational exposure.
• Despite no identified material disruption as of July 17, 2026, Ecopetrol warns the cyber incident could have a material adverse effect on its business, reputation, operating results, or financial condition.

Key Figures

Subsidiaries affected: approximately 15 subsidiaries User accounts with downloaded data: approximately 3,300 user accounts Ecopetrol workforce: more than 19,000 employees +3 more

6 metrics

Subsidiaries affected approximately 15 subsidiaries Cloud-based file storage environments with unauthorized access

User accounts with downloaded data approximately 3,300 user accounts Data associated with these accounts was unlawfully extracted

Ecopetrol workforce more than 19,000 employees Size of the company’s employee base

Colombian hydrocarbon production share more than 60% Portion of Colombia’s hydrocarbon production for which Ecopetrol is responsible

Stake in ISA 51.4% of ISA’s shares Ownership interest acquired, giving presence in energy transmission and concessions

Report date July 17, 2026 Date Ecopetrol reported the cybersecurity incident

Key Terms

ransomware attack, tactics, techniques, and procedures (TTPs), incident response and management protocols, forward-looking statements

4 terms

ransomware attack technical

"an attempted ransomware attack that was blocked by the cybersecurity controls"

tactics, techniques, and procedures (TTPs) technical

"identification, analysis, and containment of the tactics, techniques, and procedures (TTPs)"

Tactics, techniques, and procedures (TTPs) are the repeatable methods and steps that groups use to carry out actions, most often describing how cyber attackers plan, break in, move around, and achieve their goals. For investors, understanding TTPs is like knowing a burglar’s usual tools and routes: it helps assess a company’s exposure to operational or cyber risk, the likely costs of an incident, and how well management can detect and respond.

incident response and management protocols technical

"initiated an investigation and activated its incident response and management protocols"

forward-looking statements regulatory

"This release contains statements that may be considered forward-looking statements"

Forward-looking statements are predictions or plans that companies share about what they expect to happen in the future, like estimating sales or profits. They matter because they help investors understand a company's outlook, but since they are based on guesses and assumptions, they can sometimes be wrong.

FAQ

AI-generated questions and answers. How Rhea-AI works. Not financial advice.

What cybersecurity incident did Ecopetrol (EC) disclose in July 2026?

Ecopetrol disclosed a cybersecurity incident involving unauthorized access by an unidentified external actor to certain digital resources, including cloud-based file storage, plus an attempted ransomware attack that was blocked by the company’s cybersecurity controls.

How many Ecopetrol (EC) subsidiaries and user accounts were affected?

The incident affected cloud-based file storage environments of approximately 15 subsidiaries, including Ecopetrol, and involved the unauthorized download of data associated with about 3,300 user accounts, according to the company’s disclosure.

Has the Ecopetrol (EC) cyber incident disrupted operations or production?

As of July 17, 2026, Ecopetrol reports no material disruption to critical operations, production capacity, or essential services, and no direct financial impact preventing it from continuing to conduct its business activities.

What response measures has Ecopetrol (EC) taken after the cyber incident?

Ecopetrol revoked unauthorized access, blocked mass downloads, analyzed attacker tactics, filed a criminal complaint in Colombia, engaged insurers and capital markets teams, assessed downloaded data, and enhanced monitoring under critical alert protocols.

Could the Ecopetrol (EC) cybersecurity incident become financially material?

Ecopetrol states it cannot guarantee the incident will not have a material adverse effect on its business, reputation, operating results, or financial condition as it continues assessing potential exposure of corporate and personal data.

How is Ecopetrol (EC) handling potential data disclosure from the incident?

The company is deploying measures to prevent public disclosure of unlawfully extracted information, identifying external infrastructures used for storage or download, and coordinating with authorities, insurers, and specialized teams to manage supervisory, remediation, and compliance implications.

AI-generated analysis. How Rhea-AI works. Not financial advice.

Form 6-K: How Foreign Companies Report to the SEC →

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

Accepted by SEC EDGAR 07/17/2026 - 08:39 PM EDT Learn about SEC filing dates

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION Washington, D.C. 20549

FORM 6-K

REPORT OF FOREIGN PRIVATE ISSUER PURSUANT TO RULE 13a-16 OR 15d-16 UNDER THE SECURITIES EXCHANGE ACT OF 1934

For the month of July, 2026

Commission File Number 001-34175

ECOPETROL S.A.

(Exact name of registrant as specified in its charter)

N.A.

(Translation of registrant’s name into English)

COLOMBIA

(Jurisdiction of incorporation or organization)

Carrera 13 No. 36 – 24

BOGOTA D.C. – COLOMBIA

(Address of principal executive offices)

Indicate by check mark whether the registrant files or will file annual reports under cover of Form 20-F or Form 40-F.

Form 20-F x      Form 40-F ¨

Indicate by check mark if the registrant is submitting the Form 6-K in paper as permitted by Regulation S-T Rule 101(b)(1)

Yes ¨      No x

Indicate by check mark if the registrant is submitting the Form 6-K in paper as permitted by Regulation S-T Rule 101(b)(7)

Yes ¨      No x

Indicate by check mark whether the registrant by furnishing the information contained in this form is also thereby furnishing the information to the Commission pursuant to Rule 12g3-2(b) under the Securities Exchange Act of 1934.

Yes ¨      No x

If “Yes” is marked, indicate below the file number assigned to the registrant in connection with Rule 12g3-2(b): 82- N/A

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized.

	Ecopetrol S.A.
	By:	/s/ Alfonso Camilo Barco
		Name:	Alfonso Camilo Barco
		Title:	Chief Financial Officer

Date: July 17, 2026

 

Ecopetrol Reports Cybersecurity Incident

Bogota, July 17, 2026

Ecopetrol S.A. (BVC: ECOPETROL; NYSE: EC) (the “Company”) announced that it has identified an unauthorized access to certain digital resources owned by the Company and its subsidiaries by an external actor who has not been identified, as well as an attempted ransomware attack that was blocked by the cybersecurity controls implemented across the Company and its subsidiaries. The unauthorized access affected cloud-based file storage environments of approximately 15 subsidiaries (including the Company), resulting in the unauthorized download of data associated with approximately 3,300 user accounts. The external actor communicated extortion demands, threatening to publicly disclose the information that had been unlawfully extracted.

In response to this incident, the Company initiated an investigation and activated its incident response and management protocols. In addition, the Company deployed the following measures aimed at preventing the public disclosure of the unlawfully extracted information, addressing supervisory actions and/or potential financial costs associated with investigation, remediation, and regulatory compliance, as follows:

a. Immediate revocation of unauthorized access to the compromised digital assets.
b. Blocking of mechanisms associated with the mass download of information.
c. Identification, analysis, and containment of the tactics, techniques, and procedures (TTPs) used by the malicious actor.
d. Filing of a criminal complaint before the Office of the Attorney General of Colombia and deployment of cooperation activities with specialized national authorities.
e. Identification of external infrastructures used for the storage or download of information to pursue restriction or blocking actions.
f. Activation of support mechanisms with insurers and specialized capital markets teams to ensure the proper management of the event.
g. Detailed assessment of the downloaded information and determination of its criticality.
h. Enhanced monitoring of the technology infrastructure under critical alert protocols and continuous validation of preventive and detective controls.

As of the date of this report, the Company has not identified any material disruption to its critical operations, production capacity, or essential services; any direct financial impact that would prevent it from continuing to conduct its business activities; or any disclosure of the information subject to the unauthorized access. However, the Company continues to assess the potential exposure of corporate information, which could include confidential, restricted, proprietary, or personal data, as it cannot guarantee that this incident will not have a material adverse effect on the Company's business, reputation, operating results, or financial condition.

Ecopetrol S.A. will continue to monitor developments related to this matter and, should any material facts or information requiring disclosure to the market be identified, will promptly disclose such information in accordance with applicable laws and regulations.

------------------------------------- 

Ecopetrol is the largest company in Colombia and one of the main integrated energy companies in the American continent, with more than 19,000 employees. In Colombia, it is responsible for more than 60% of the hydrocarbon production of most transportation, logistics, and hydrocarbon refining systems, and it holds leading positions in the petrochemicals and gas distribution segments. With the acquisition of 51.4% of ISA’s shares, the company participates in energy transmission, the management of real-time systems (XM), and the Barranquilla - Cartagena coastal highway concession. At the international level, Ecopetrol has a stake in strategic basins in the American continent, with Drilling and Exploration operations in the United States (Permian basin and the Gulf of Mexico), Brazil, and Mexico, and, through ISA and its subsidiaries, Ecopetrol holds leading positions in the power transmission business in Brazil, Chile, Peru, and Bolivia, road concessions in Chile, and the telecommunications sector.

 

This release contains statements that may be considered forward-looking statements within the meaning of Section 27A of the U.S. Securities Act of 1933, as amended, and Section 21E of the U.S. Securities Exchange Act of 1934, as amended. All forward-looking statements, whether made in this release or in future filings or press releases, or orally, address matters that involve risks and uncertainties, including in respect of the Company’s prospects for growth and its ongoing access to capital to fund the Company’s business plan, among others. Consequently, changes in the following factors, among others, could cause actual results to differ materially from those included in the forward-looking statements: market prices of oil & gas, our exploration, and production activities, market conditions, applicable regulations, the exchange rate, the Company’s competitiveness and the performance of Colombia’s economy and industry, to mention a few. We do not intend and do not assume any obligation to update these forward-looking statements.

For more information, please contact:

Investor Relations Office

Email: investors@ecopetrol.com.co  

Head of Corporate Communications (Colombia)  

Marcela Ulloa  

Email: marcela.ulloa@ecopetrol.com.co 

Filing Exhibits & Attachments

1 document

Press Releases

• EX-99.1 EX-99.1 9.1 KB