Ecopetrol Ransomware Attack, July 2026: The Gentlemen, 3,300 Accounts and a Terabyte of Leaked Documents

On 17 July 2026, Colombia's largest company did what most ransomware victims fail to do: it stopped the encryption. Ecopetrol's security controls blocked the payload before a single production system was locked. Refineries kept running. Pipelines kept moving. And the company still lost the incident.

By late July, files belonging to 15 companies of the Ecopetrol Group were circulating publicly, the attacker was demanding payment to stop further publication, and the company was coordinating with the Attorney General's cybercrime unit and the Ministry of ICT to get the leaked material taken down.

This is the shape of modern extortion. The encryption event is the part defenders are ready for. The theft that precedes it is the part that decides the outcome.

What Ecopetrol Confirmed

Ecopetrol's own disclosures describe an intrusion with a clear boundary between what was stopped and what was not.

The company identified unauthorized access to certain digital resources by an external actor, together with an attempted ransomware execution that was blocked in time by its cybersecurity controls. The unauthorized access reached cloud file storage environments belonging to approximately 15 companies of the Ecopetrol Group, and resulted in the unauthorized download of data associated with roughly 3,300 user accounts.

Ecopetrol stated it had not identified any material interruption of critical operations, production capacity, or essential services.

The response was fast and by the book: unauthorized credentials revoked, mass-download mechanisms blocked, attacker techniques identified, a criminal complaint filed with the Fiscalía General de la Nación, and specialised firms engaged alongside national authorities.

Key Findings

The ransomware encryption was blocked. The data theft was not - and the theft is what the extortion now runs on.
Cloud file storage across roughly 15 group companies was the access surface, not the industrial control environment.
Data tied to approximately 3,300 user accounts was downloaded without authorization; the attacker claims roughly one terabyte of corporate documents.
Operational technology and production were not materially disrupted, which separates this from an OT-impact scenario.
After the deadline passed, material attributed to the 15 group companies was published, moving the incident from intrusion to public leak.

Why "Ransomware Blocked" Was Only Half the Result

There is a reflex in incident communication to treat a blocked encryption as a win. Operationally, it is. A national oil company that keeps producing through a ransomware intrusion has protected the thing that matters most to the country.

But double extortion was designed precisely to survive that outcome. The modern playbook steals first and encrypts second, so that a victim with excellent backups and a working anti-ransomware control is still holding a loaded gun pointed at its own reputation, its counterparties, and its personnel.

When encryption fails, the crew does not walk away. It falls back to the copy it already has.

"Blocking the encryption saves the operation. It does not end the incident. The data left the building days before the payload ever ran."

Who Is The Gentlemen

Reporting has attributed the Ecopetrol intrusion to The Gentlemen, a Ransomware-as-a-Service operation that has moved from obscurity to the front rank of the ecosystem in under a year. Colombia's national CERT, ColCERT, had already linked the group to more than 200 attacks across 50 countries by April 2026.

THREAT ACTOR PROFILE - THE GENTLEMEN

Model: Ransomware-as-a-Service, with affiliates reportedly retaining up to 90% of proceeds. Prospective affiliates must prove capability by presenting previously stolen data.
Encryptor: written in Go, with builds for Windows servers, Linux, BSD, and virtualised environments.
Execution control: the payload requires a specific password to run, limiting uncontrolled spread and frustrating sandbox analysis.
Reach: active in more than 50 countries, accounting for roughly 10% of global ransomware activity - second only to Qilin.
Target sectors: manufacturing, construction, healthcare, finance, and energy.
Pressure model: double extortion - exfiltrate, then encrypt, then threaten dark-web publication.

The cross-platform encryptor matters more than it sounds. Builds for Linux, BSD, and hypervisors mean the group is engineered for exactly the environments where Latin American enterprises consolidate their most critical workloads: virtualisation clusters and cloud-adjacent file infrastructure.

Anatomy of a Gentlemen Intrusion

The reported tradecraft follows a recognisable sequence, and every stage of it is observable before the payload runs.

1.Initial access through remote administration interfaces with weak protection, stolen or purchased credentials, or unpatched VPN appliances - Fortinet FortiGate flaws are specifically associated with this crew.
2.Reconnaissance using commodity tooling such as Advanced IP Scanner and Nmap to map the reachable estate.
3.Privilege escalation, with domain administrator rights treated as the critical objective rather than a convenience.
4.Defense evasion, disabling antivirus and eliminating forensic traces to slow both detection and later reconstruction.
5.Exfiltration at scale, pulling document repositories to attacker-controlled infrastructure.
6.Encryption, which once administrative control is established can lock critical systems within minutes.
7.Extortion, with a payment demand backed by the threat of publication, followed by the leak itself when the deadline expires.

Critical Observation

Stages one through five leave weeks of behavioural evidence. Stage six leaves minutes. Any detection strategy weighted toward the encryption event is optimising for the shortest and least recoverable window in the entire attack.

The Real Failure Point: Bulk Download From Cloud File Storage

Strip the incident to its mechanics and one action defines it. An external actor, operating with credentials the environment accepted as legitimate, performed a mass download from the cloud file storage of roughly 15 separate group companies, touching data associated with about 3,300 accounts.

That is not a subtle action. A single identity reaching across the file estates of fifteen distinct corporate entities and pulling documents at volume is one of the loudest behavioural signals an enterprise can generate. It is anomalous in scope, in volume, and in cross-entity reach simultaneously.

The detonation was caught. The download that made the detonation optional was not caught in time.

This is the structural gap in most large enterprise programs: heavy investment in payload-level prevention, comparatively light investment in behavioural detection of data movement by authorised-looking identities.

Detection Opportunities

A single account reading or downloading documents at volumes far outside its own established baseline.
Cross-entity access: one identity touching file repositories belonging to multiple subsidiaries or business units in a short window.
Authentication anomalies - off-hours sessions, impossible-travel events, bursts of failed VPN attempts against edge appliances.
Reconnaissance tooling such as Advanced IP Scanner or Nmap executing in an administrative context.
Sustained outbound transfers to unfamiliar cloud storage endpoints or hosting ranges.
Attempts to disable endpoint protection, clear event logs, or reach backup infrastructure.

What This Means for Colombian Critical Infrastructure

Ecopetrol is not an outlier. It is the most visible data point in a pattern ColCERT has been tracking across Colombian government and industry through 2026, and the energy sector sits squarely inside The Gentlemen's declared targeting.

Three implications follow for any operator of national significance in the region.

Group structure is attack surface. A holding company with fifteen subsidiaries sharing identity and cloud storage infrastructure has fifteen ways in and one blast radius. Shared tenancy is efficient until it becomes a single unauthorized session with reach across every entity.

Cloud file estates are now primary targets. The valuable material is no longer only on file servers behind a firewall. It is in cloud storage reachable with a credential, from anywhere, at machine speed.

Blocked encryption will keep producing leaked data. As anti-ransomware controls improve, crews lean harder on the exfiltration half of the model. Expect more incidents that look exactly like this one: operations intact, documents public.

Recommended Countermeasures

Enforce phishing-resistant MFA on every remote-access, administrative, and cross-entity account without exception.
Patch internet-facing VPN and firewall appliances on a defined SLA and treat them as tier-zero assets.
Baseline normal data-access volume per identity and per role, then alert on deviation rather than on fixed thresholds.
Segment identity and storage between group companies so one compromised session cannot span the portfolio.
Classify and label sensitive documents so that movement of high-value material is itself a detectable event.
Rehearse the leak scenario, not only the encryption scenario - legal, regulatory, and communications response included.

Where DATAENFORCE Technology Changes the Outcome

The Ecopetrol incident is unusually instructive for defenders because the failure point is so precisely located. The anti-ransomware layer performed. The data-movement detection layer did not perform in time. DATAENFORCE builds for both halves, and specifically for the half that decided this case.

[OSPREY](/en/products/osprey) exists for exactly this failure mode. It profiles behavioural baselines per identity and per role, then surfaces the deviations that precede extortion: bulk document reads, cross-entity access by a single account, staging activity, and outbound transfer to uncontrolled endpoints. A mass download spanning fifteen group companies is not a subtle signal against a behavioural baseline - it is the loudest possible one. Detection in that window is the difference between an intrusion and a leak.

[VALIANT](/en/products/valiant) addresses the ransomware and data-extortion layer directly, intercepting payload execution and the pre-encryption behaviours that lead to it. Ecopetrol's controls blocked the detonation, which is the outcome VALIANT is engineered to guarantee rather than to leave to chance across a fifteen-company estate.

[INFOTRACK](/en/products/infotrack) governs document tracking and information lifecycle. When exfiltration does occur, the decisive question within the first hours is which documents actually left and how sensitive they are. Ecopetrol spent the days after the intrusion assessing precisely that. Document-level tracking converts that assessment from a forensic reconstruction into a query, and it directly supports the takedown and notification effort that follows.

[DAEDALUS](/en/products/daedalus) covers the entry side - malware, phishing, and smishing analysis - where stolen credentials and initial access are manufactured before any of the later stages become possible.

Executive Takeaways

Treat exfiltration detection as a peer of anti-ransomware control, not as a subordinate capability.
Instrument identity behaviour across group companies, because attackers traverse corporate boundaries that defenders monitor separately.
Know what left. Document-level visibility determines the quality of every decision made after an intrusion.
Assume the leak scenario. Rehearse it with legal and communications at the table before it is needed.
Patch and harden edge access first - it remains the most reliably exploited path into Latin American enterprises.

Strategic Assessment

Ecopetrol protected the asset the country most needed protected. Production continued and critical operations held. On the measure that matters to national energy security, the defense worked.

On the measure that matters to information security, the adversary achieved its objective. It obtained the data, retained leverage after encryption failed, and executed the leak.

The lesson for every large operator in Colombia and the wider region is not that Ecopetrol was unprepared. It is that being prepared for encryption is no longer the same thing as being prepared for ransomware.

Sources

About this report

This article is based on publicly reported information about the 17 July 2026 Ecopetrol cybersecurity incident and on published analysis of The Gentlemen ransomware operation, current as of 3 August 2026. Attribution to The Gentlemen reflects public reporting and has not been confirmed by DATAENFORCE independently. Figures for accounts, affected group companies, and claimed data volume are as reported by the sources cited above and may be revised as the investigation advances. Nothing here should be read as a finding about Ecopetrol's internal security posture, which is not public. This is a strategic briefing for critical-infrastructure security leaders, not legal or incident-specific advice.