Colombian energy giant Ecopetrol says thousands of user accounts hit by cyberattack

Ecopetrol confirms ransomware attempt in which attackers stole data from 3,300 user accounts but failed to deploy encryptor due to security controls
The stolen files were pseudonymous, without compromising the users’ identities or credentials; transactional systems and partner networks are not affected
The company chased away the attackers, launched an investigation and informed Colombian authorities; no details about the ransom demand or any data leak have surfaced so far

Latin American energy producer Ecopetrol has revealed that it has been the victim of a ransomware attack. Even though the threat actors were able to capture sensitive data from thousands of user accounts, they were unable to deploy the encryptor and disrupt the company’s daily operations.

In a statement shared with the public, Ecopetrol explained how an unidentified malicious actor accessed its IT infrastructure and extracted data from 3,300 user accounts. The attacker then proceeded to install an encryptor but was stopped by the company’s security controls.

Despite failing to deploy the encryptor, the threat actor still contacted the company to demand payment. We don’t know how much money they asked for in exchange for not sharing the stolen files. The database has not yet leaked, it appears, and no one has claimed responsibility for the intrusion. At the same time, Ecopetrol claims that the stolen files are pseudonymous, suggesting that they might not be particularly useful to attackers:

Notify the authorities

“The identities of the users of the 3,300 illegally infiltrated accounts were not affected, nor were the access credentials of the respective users captured,” the machine-translated announcement said. “Ecopetrol SA confirms that no compromise has been identified in the transactional technological solutions of its digital ecosystem, those of its subsidiaries or those of its network of commercial, financial, service providers and customers allies.”

Ecopetrol said it successfully ousted the attackers and stopped any further data exfiltration. She also launched an internal investigation and informed the relevant authorities, including the Colombian Attorney General’s Office, the Joint Cyber Command of the Military Forces, among others.

The investigation is still ongoing.

Ecopetrol is Colombia’s state-controlled oil and gas giant. It manages production, refining, transportation and exploration operations and is present in several countries, including Chile, Peru and Bolivia. Its annual turnover is around $30 billion.

Via Cybernews