Unauthorized access reached Ecopetrol cloud file storage across about 15 subsidiaries, and data associated with roughly 3,300 accounts was downloaded, the Colombian energy company said, while its controls separately blocked an attempted ransomware attack. [1]

An unidentified actor made extortion demands, but Ecopetrol neither identified that actor nor described the data types taken, omissions that keep attribution and the consequences for affected people open even though the intrusion itself is no longer hypothetical. [1]

Ecopetrol said the incident had caused no material disruption to critical operations, production capacity or essential services as of its release, wording that marks a first-party operating assessment at a particular time rather than independent confirmation of containment or a guarantee against later disclosure. [1]

Theft from cloud file storage is a material data event but does not by itself establish access to industrial controls, pipeline systems or production equipment, just as a blocked ransomware attempt shows one attack path met resistance without proving every compromised credential or copied file has been accounted for.

No verified X post was recovered, so an energy-shock frame would be invention rather than platform observation, and until affected data types, required notices, involved subsidiaries, independent containment findings or operating consequences emerge, this remains confirmed data theft and attempted extortion rather than a demonstrated oil-supply emergency.

-- LUCIA VEGA, São Paulo