What happened

Ecopetrol detected unauthorized access to cloud file-storage environments used by about 15 group companies, with files associated with approximately 3,300 user accounts downloaded. The attacker then attempted to destroy, delete or encrypt data, but Ecopetrol said its security controls blocked the ransomware payload and found no compromise of transactional systems, user identities or access credentials. The company reported no material interruption to critical operations, production capacity or essential services. The Gentlemen ransomware group later claimed responsibility and asserted that it held roughly one terabyte of data, including drilling and corporate records; samples reviewed by outside reporting appeared consistent with genuine company documents, but Ecopetrol did not validate the group's total-volume or file-content claims. This is therefore a confirmed corporate data-theft and attempted-ransomware incident without demonstrated operational-technology or production impact.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.