Ecopetrol details impact of cybersecurity incident
Ecopetrol S.A. reports that updated analyses of the July 2026 cybersecurity incident indicate the impact was limited exclusively to the downloading of files.
Rhea-AI Filing Summary
Ecopetrol S.A. reports that updated analyses of the July 2026 cybersecurity incident indicate the impact was limited exclusively to the downloading of files. No compromise to the integrity of the information has been identified, even though an external threat actor attempted to destroy, delete, or encrypt data. The identities of users associated with the 3,300 accounts that were unlawfully infiltrated and their access credentials were not compromised, and no compromise has been identified in transactional technology solutions of Ecopetrol, its subsidiaries, or its commercial and financial partners.
The company states that containment efforts are in an advanced phase, focusing on classifying the downloaded information, assessing and managing extortion demands and threats based on unlawfully obtained information, and working with Colombian authorities including ColCERT, the Attorney General’s cybercrime directorate, the Joint Cyber Command, and the National Police cybercrime center. Operational activities of Ecopetrol and its business group continue without interruption while monitoring and response efforts remain ongoing.
Positive
- None.
Negative
- Cyber incident involved unauthorized file downloads linked to 3,300 user accounts and extortion threats.
Key Figures
Key Terms
cybersecurity incident technical
critical national infrastructure regulatory
Cyber Emergency Response Team (ColCERT) technical
forward-looking statements regulatory
FAQ
What did Ecopetrol (EC) disclose about the July 2026 cybersecurity incident?
How many user accounts were affected in Ecopetrol’s (EC) cybersecurity incident?
Were Ecopetrol’s (EC) operations or transactional systems disrupted by the cyber incident?
What actions is Ecopetrol (EC) taking in response to the cybersecurity incident?
Which authorities are assisting Ecopetrol (EC) with the cybersecurity incident?
Did Ecopetrol (EC) report any compromise of user identities or access credentials?
AI-generated analysis. How Rhea-AI works. Not financial advice.
UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
FORM 6-K
REPORT OF FOREIGN PRIVATE ISSUER
PURSUANT TO RULE 13a-16 OR 15d-16 UNDER
THE SECURITIES EXCHANGE ACT OF 1934
For the month of July, 2026
Commission File Number 001-34175
| ECOPETROL S.A. |
|
(Exact name of registrant as specified in its charter)
|
| N.A. |
|
(Translation of registrant’s name into English)
|
| COLOMBIA |
|
(Jurisdiction of incorporation or organization)
|
| Carrera 13 No. 36 – 24 |
| BOGOTA D.C. – COLOMBIA |
| (Address of principal executive offices) |
Indicate by check mark whether the registrant files or will file annual reports under cover of Form 20-F or Form 40-F.
Form 20-F x Form 40-F ¨
Indicate by check mark if the registrant is submitting the Form 6-K in paper as permitted by Regulation S-T Rule 101(b)(1)
Yes ¨ No x
Indicate by check mark if the registrant is submitting the Form 6-K in paper as permitted by Regulation S-T Rule 101(b)(7)
Yes ¨ No x
Indicate by check mark whether the registrant by furnishing the information contained in this form is also thereby furnishing the information to the Commission pursuant to Rule 12g3-2(b) under the Securities Exchange Act of 1934.
Yes ¨ No x
If “Yes” is marked, indicate below the file number assigned to the registrant in connection with Rule 12g3-2(b): 82- N/A
SIGNATURES
Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized.
| Ecopetrol S.A. | ||||
|
By: |
/s/ Alfonso Camilo Barco | |||
| Name: |
Alfonso Camilo Barco |
|||
| Title: | Chief Financial Officer | |||
Date: July 20, 2026
Ecopetrol Continues to Implement Monitoring and Protection Measures in Response to Cybersecurity Incident
Bogotá, July 20, 2026
Ecopetrol S.A. (BVC: ECOPETROL; NYSE: EC) reports that the latest analyses conducted regarding the cybersecurity incident and its effects, previously disclosed on July 17, indicate that the impact was limited exclusively to the downloading of files. Accordingly, no compromise to the integrity of the information has been identified, despite the external threat actor’s attempts to destroy, delete, and/or encrypt data. The identities of users associated with the 3,300 accounts that were unlawfully infiltrated were not compromised, nor were any user access credentials captured.
Ecopetrol S.A. also confirms that no compromise has been identified in the transactional technology solutions within its digital ecosystem, those of its subsidiaries, or those of its network of commercial and financial partners, suppliers, and customers.
The Company and its subsidiaries continue to carry out containment efforts, now in an advanced phase, prioritizing the following actions:
· Classification of the information downloaded as a result of the incident.
· Assessment and management of extortion demands and threats based on information unlawfully obtained by the external threat actor, which have been reported to the relevant authorities.
· Ongoing collaboration with Colombia’s Cyber Emergency Response Team (ColCERT), given Ecopetrol’s designation as critical national infrastructure; the Specialized Directorate for Cybercrime of the Office of the Attorney General; the Joint Cyber Command of the Colombian Armed Forces (CCOCI); and the Cybercrime Center of the National Police’s Criminal Investigation Directorate (DIJIN).
The operational activities of the Company and its Business Group continue without interruption, while efforts to monitor and address the cybersecurity incident remain ongoing.
-------------------------------------
Ecopetrol is the largest company in Colombia and one of the main integrated energy companies in the American continent, with more than 19,000 employees. In Colombia, it is responsible for more than 60% of the hydrocarbon production of most transportation, logistics, and hydrocarbon refining systems, and it holds leading positions in the petrochemicals and gas distribution segments. With the acquisition of 51.4% of ISA’s shares, the company participates in energy transmission, the management of real-time systems (XM), and the Barranquilla - Cartagena coastal highway concession. At the international level, Ecopetrol has a stake in strategic basins in the American continent, with Drilling and Exploration operations in the United States (Permian basin and the Gulf of Mexico), Brazil, and Mexico, and, through ISA and its subsidiaries, Ecopetrol holds leading positions in the power transmission business in Brazil, Chile, Peru, and Bolivia, road concessions in Chile, and the telecommunications sector.
This release contains statements that may be considered forward-looking statements within the meaning of Section 27A of the U.S. Securities Act of 1933, as amended, and Section 21E of the U.S. Securities Exchange Act of 1934, as amended. All forward-looking statements, whether made in this release or in future filings or press releases, or orally, address matters that involve risks and uncertainties, including in respect of the Company’s prospects for growth and its ongoing access to capital to fund the Company’s business plan, among others. Consequently, changes in the following factors, among others, could cause actual results to differ materially from those included in the forward-looking statements: market prices of oil & gas, our exploration, and production activities, market conditions, applicable regulations, the exchange rate, the Company’s competitiveness and the performance of Colombia’s economy and industry, to mention a few. We do not intend and do not assume any obligation to update these forward-looking statements.
For more information, please contact:
Investor Relations Office
Email: investors@ecopetrol.com.co
Head of Corporate Communications (Colombia)
Marcela Ulloa
Email: marcela.ulloa@ecopetrol.com.co