Ransomware Attack on Ecopetrol: 3,300 Accounts Hit, Encryptor Blocked

Full text

Ecopetrol confirms ransomware attempt in which attackers stole data from 3,300 user accounts but failed to deploy the encryptor due to security controls

Stolen files were pseudonymous, with no user identities or credentials compromised; transactional systems and partner networks remained unaffected

The company ousted the attackers, launched an investigation, and notified Colombian authorities; no ransom demand details or data leaks have surfaced so far

Latin American energy producer Ecopetrol has revealed it was victim of a ransomware attack, and while the threat actors managed to get away with sensitive data from thousands of user accounts, they were unable to deploy the encryptor and thus disrupt the company’s day-to-day operations.

In a statement shared with the public, Ecopetrol explained how an unidentified threat actor accessed their IT infrastructure and pulled data from 3,300 user accounts. The attacker then proceeded to install an encryptor but was stopped by the company’s security controls.

Despite failing to deploy the encryptor, the threat actor still reached out to the company demanding payment. We don’t know how much money they asked for, in exchange for not sharing the stolen files. The database has not yet leaked, it seems, and no one claimed responsibility for the intrusion. At the same time, Ecopetrol says the stolen files are pseudonymous, suggesting that they might not be particularly useful to the attackers:

Notifying the authorities

“The identity of the users of the 3,300 accounts that were illegally infiltrated was not affected, nor were the respective user access credentials captured,” the machine-translated announcement reads. “Ecopetrol S.A. confirms that no compromises have been identified in the transactional technological solutions of its digital ecosystem, those of its subsidiaries, or those of its network of commercial allies, financiers, providers, and clients.”

Ecopetrol said that it managed to oust the attackers and stop further data exfiltration. It also launched an internal investigation and notified relevant authorities, including the Colombian Attorney General’s Office, the Joint Cyber Command of the Military Forces, and others.

The investigation remains ongoing.

Ecopetrol is Colombia's state-controlled oil and gas giant. It runs production, refining, transportation, and exploration operations, and is present in multiple countries, including Chile, Peru, and Bolivia. Its annual revenue is around $30 billion.

Via Cybernews