Colombian energy giant Ecopetrol says thousands of user accounts have been affected by cyber attacks

Ecopetrol confirms attempted ransomware in which attackers stole data from 3,300 user accounts but failed to implement the encryption tool due to security controls
Stolen files were pseudonymous, with no user identities or credentials compromised; transaction systems and partner networks remained unaffected
The company expelled the attackers, launched an investigation and notified the Colombian authorities; no information about ransom or data breach has surfaced so far

Latin American energy producer Ecopetrol has revealed that it was the victim of a ransomware attack, and while the threat actors managed to get away with sensitive data from thousands of user accounts, they were unable to implement the encryption, disrupting the company’s day-to-day operations.

In a statement shared with the public, Ecopetrol explained how an unidentified threat actor gained access to their IT infrastructure and extracted data from 3,300 user accounts. The attacker then proceeded to install an encryption but was stopped by the company’s security controls.

Despite not implementing the encryption tool, the threat actor still reached out to the company and demanded payment. We don’t know how much money they asked for in exchange for not sharing the stolen files. The database has not yet been leaked, it seems, and no one claimed responsibility for the breach. At the same time, Ecopetrol says that the stolen files are pseudonymous, suggesting that they may not be particularly useful to the attackers:

Notification to the authorities

“The identity of the users of the 3,300 accounts that were illegally infiltrated was not affected, nor were the respective user credentials captured,” the machine-translated announcement reads. “Ecopetrol SA confirms that no compromises have been identified in the transactional technological solutions of its digital ecosystem, its subsidiaries or its network of commercial allies, financiers, providers and customers.”

Ecopetrol said it managed to repel the attackers and stop further data exfiltration. It also launched an internal investigation and notified relevant authorities, including the Colombian Minister of Justice, the Joint Cyber Command of the Military Forces and others.

The investigation is still ongoing.

Ecopetrol is Colombia’s state-controlled oil and gas giant. It operates production, refining, transportation and exploration and is present in several countries, including Chile, Peru and Bolivia. Its annual turnover is about 30 billion dollars.

Via Cyber news