Ecopetrol confirms ransomware attempt, data stolen from 3,300 accounts

Ecopetrol, a Latin American energy producer, has confirmed a ransomware attack where attackers stole data from 3,300 user accounts but were prevented from deploying an encryptor due to security controls, according to a recent report by Tech Radar.

The incident involved an unidentified threat actor accessing Ecopetrol's IT infrastructure and exfiltrating pseudonymous data from 3,300 user accounts. While the attackers attempted to install an encryptor, the company's security measures successfully blocked its deployment, preventing disruption to transactional systems and partner networks. No user identities or credentials were compromised.

Ecopetrol has since removed the attackers from its systems and launched an internal investigation. The company has also notified Colombian authorities, including the Attorney General's Office and the Military Forces' Joint Cyber Command. No ransom demand details or confirmation of data leaks have been publicly disclosed thus far. The stolen files are reported to be pseudonymous, potentially limiting their utility to the attackers.

Source: Tech Radar