RANSOMWARE VICTIMENERGY

Ecopetrol

THEGENTLEMEN📍 Colombia (CO)📅 July 18, 2026
8
same group

Attack Intelligence

Ecopetrol was compromised in a ransomware attack attributed to THEGENTLEMEN in July 2026. The organization, operating in the Energy sector in Colombia, was added to the group's data leak site as part of an extortion campaign.

THEGENTLEMEN operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

$33.1 Billion www.ecopetrol.com.co ECOPETROL copetrol SA is a company organized as a public limited company, of national order, linked to the Ministry of Mines and Energy. It has operations located in the center, south, east and north of Colombia, as well as abroad. It has two refineries in Barrancabermeja and Cartagena. Through its subsidiary Cenit, specialized in hydrocarbon transportation and logistics, it owns three ports for the export and import of fuels and crude oil in Coveñas (Sucre) and Cartagena (Bolvar) with access to the Atlantic, and Tumaco (Nariño) on the Pacific. Cenit also owns most of the country's oil and multi-purpose pipelines that connect production systems with large consumption centers and maritime terminals. Ecopetrol also has a stake in the biofuels business and is present in Brazil, Mexico and the United States (Gulf of Mexico and Permian Texas). CHANGE NEGOTIATOR IMMEDIATLY. CONTACT - CONFIRM. Drop in stock - free gift.

Additional Details

Other Victims — THEGENTLEMEN (8)

Quick Facts

CountryColombia (CO)
SectorEnergy
Attack DateJul 18, 2026
Intel Sourceransomlook

Threat Group

THEGENTLEMEN
Motivation: financial
View group profile →

External Links

Data sourced from Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Victim listing does not imply confirmed breach — intelligence based on group claims.