Cyber incident hits Ecopetrol S.A. (NYSE: EC), affecting 3,300 user accounts
Rhea-AI Filing Summary
Ecopetrol S.A. reported a cybersecurity incident involving unauthorized access by an unidentified external actor to certain digital resources of the company and its subsidiaries, including cloud-based file storage. An attempted ransomware attack was blocked by cybersecurity controls.
The incident affected cloud environments of approximately 15 subsidiaries, including Ecopetrol, and led to the unauthorized download of data linked to about 3,300 user accounts. The external actor issued extortion demands, threatening to disclose the unlawfully extracted information.
Ecopetrol activated incident response and management protocols, revoked unauthorized access, blocked mass-download mechanisms, analyzed the attacker’s tactics, filed a criminal complaint in Colombia, engaged insurers and specialized teams, and enhanced infrastructure monitoring. As of July 17, 2026, it has not identified material disruption to critical operations, production capacity, essential services, or direct financial impacts preventing normal business, nor any public disclosure of the accessed information, but acknowledges the incident could still have a material adverse effect on its business, reputation, results, or financial condition.
Positive
- None.
Negative
- Unauthorized access to cloud-based storage affected approximately 15 subsidiaries and data linked to about 3,300 user accounts, creating potential legal, financial, and reputational exposure.
- Despite no identified material disruption as of July 17, 2026, Ecopetrol warns the cyber incident could have a material adverse effect on its business, reputation, operating results, or financial condition.
Key Figures
Key Terms
ransomware attack technical
tactics, techniques, and procedures (TTPs) technical
incident response and management protocols technical
forward-looking statements regulatory
AI-generated analysis. How Rhea-AI works. Not financial advice.
FAQ
What cybersecurity incident did Ecopetrol (EC) disclose in July 2026?
How many Ecopetrol (EC) subsidiaries and user accounts were affected?
Has the Ecopetrol (EC) cyber incident disrupted operations or production?
What response measures has Ecopetrol (EC) taken after the cyber incident?
Could the Ecopetrol (EC) cybersecurity incident become financially material?
How is Ecopetrol (EC) handling potential data disclosure from the incident?
UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
FORM 6-K
REPORT OF FOREIGN PRIVATE ISSUER
PURSUANT TO RULE 13a-16 OR 15d-16 UNDER
THE SECURITIES EXCHANGE ACT OF 1934
For the month of July, 2026
Commission File Number 001-34175
| ECOPETROL S.A. |
|
(Exact name of registrant as specified in its charter)
|
| N.A. |
|
(Translation of registrant’s name into English)
|
| COLOMBIA |
|
(Jurisdiction of incorporation or organization)
|
| Carrera 13 No. 36 – 24 |
| BOGOTA D.C. – COLOMBIA |
| (Address of principal executive offices) |
Indicate by check mark whether the registrant files or will file annual reports under cover of Form 20-F or Form 40-F.
Form 20-F x Form 40-F ¨
Indicate by check mark if the registrant is submitting the Form 6-K in paper as permitted by Regulation S-T Rule 101(b)(1)
Yes ¨ No x
Indicate by check mark if the registrant is submitting the Form 6-K in paper as permitted by Regulation S-T Rule 101(b)(7)
Yes ¨ No x
Indicate by check mark whether the registrant by furnishing the information contained in this form is also thereby furnishing the information to the Commission pursuant to Rule 12g3-2(b) under the Securities Exchange Act of 1934.
Yes ¨ No x
If “Yes” is marked, indicate below the file number assigned to the registrant in connection with Rule 12g3-2(b): 82- N/A
SIGNATURES
Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized.
| Ecopetrol S.A. | ||||
|
By: |
/s/ Alfonso Camilo Barco | |||
| Name: |
Alfonso Camilo Barco |
|||
| Title: | Chief Financial Officer | |||
Date: July 17, 2026
Ecopetrol Reports Cybersecurity Incident
Bogota, July 17, 2026
Ecopetrol S.A. (BVC: ECOPETROL; NYSE: EC) (the “Company”) announced that it has identified an unauthorized access to certain digital resources owned by the Company and its subsidiaries by an external actor who has not been identified, as well as an attempted ransomware attack that was blocked by the cybersecurity controls implemented across the Company and its subsidiaries. The unauthorized access affected cloud-based file storage environments of approximately 15 subsidiaries (including the Company), resulting in the unauthorized download of data associated with approximately 3,300 user accounts. The external actor communicated extortion demands, threatening to publicly disclose the information that had been unlawfully extracted.
In response to this incident, the Company initiated an investigation and activated its incident response and management protocols. In addition, the Company deployed the following measures aimed at preventing the public disclosure of the unlawfully extracted information, addressing supervisory actions and/or potential financial costs associated with investigation, remediation, and regulatory compliance, as follows:
a. Immediate revocation of unauthorized access to the compromised digital
assets.
b. Blocking of mechanisms associated with the mass download of information.
c. Identification, analysis, and containment of the tactics, techniques, and procedures (TTPs) used by the malicious actor.
d. Filing of a criminal complaint before the Office of the Attorney General of Colombia and deployment of cooperation activities with
specialized national authorities.
e. Identification of external infrastructures used for the storage or download of information to pursue restriction or blocking actions.
f. Activation of support mechanisms with insurers and specialized capital markets teams to ensure the proper management of the event.
g. Detailed assessment of the downloaded information and determination of its criticality.
h. Enhanced monitoring of the technology infrastructure under critical alert protocols and continuous validation of preventive and detective
controls.
As of the date of this report, the Company has not identified any material disruption to its critical operations, production capacity, or essential services; any direct financial impact that would prevent it from continuing to conduct its business activities; or any disclosure of the information subject to the unauthorized access. However, the Company continues to assess the potential exposure of corporate information, which could include confidential, restricted, proprietary, or personal data, as it cannot guarantee that this incident will not have a material adverse effect on the Company's business, reputation, operating results, or financial condition.
Ecopetrol S.A. will continue to monitor developments related to this matter and, should any material facts or information requiring disclosure to the market be identified, will promptly disclose such information in accordance with applicable laws and regulations.
-------------------------------------
Ecopetrol is the largest company in Colombia and one of the main integrated energy companies in the American continent, with more than 19,000 employees. In Colombia, it is responsible for more than 60% of the hydrocarbon production of most transportation, logistics, and hydrocarbon refining systems, and it holds leading positions in the petrochemicals and gas distribution segments. With the acquisition of 51.4% of ISA’s shares, the company participates in energy transmission, the management of real-time systems (XM), and the Barranquilla - Cartagena coastal highway concession. At the international level, Ecopetrol has a stake in strategic basins in the American continent, with Drilling and Exploration operations in the United States (Permian basin and the Gulf of Mexico), Brazil, and Mexico, and, through ISA and its subsidiaries, Ecopetrol holds leading positions in the power transmission business in Brazil, Chile, Peru, and Bolivia, road concessions in Chile, and the telecommunications sector.
This release contains statements that may be considered forward-looking statements within the meaning of Section 27A of the U.S. Securities Act of 1933, as amended, and Section 21E of the U.S. Securities Exchange Act of 1934, as amended. All forward-looking statements, whether made in this release or in future filings or press releases, or orally, address matters that involve risks and uncertainties, including in respect of the Company’s prospects for growth and its ongoing access to capital to fund the Company’s business plan, among others. Consequently, changes in the following factors, among others, could cause actual results to differ materially from those included in the forward-looking statements: market prices of oil & gas, our exploration, and production activities, market conditions, applicable regulations, the exchange rate, the Company’s competitiveness and the performance of Colombia’s economy and industry, to mention a few. We do not intend and do not assume any obligation to update these forward-looking statements.
For more information, please contact:
Investor Relations Office
Email: investors@ecopetrol.com.co
Head of Corporate Communications (Colombia)
Marcela Ulloa
Email: marcela.ulloa@ecopetrol.com.co