🇨🇴 🚨 ECOPETROL DATA ALLEGEDLY OFFERED FOR SALE 1.0 TB / ~327K FILES CLAIMED
A threat actor on an underground forum claims to be selling a large dataset allegedly associated with Ecopetrol S.A., Colombia’s national oil and gas company.
Observed claim details:
* Alleged volume: ~1.0 TB and ~327,095 files
* Alleged scope: Ecopetrol internal network shares plus named subsidiaries HOCOL, CENIT, and EUST
* Alleged content categories: upstream/drilling operations, finance and tax records, HR/personnel and medical-benefit materials, geology/engineering files, IT/VPN and credential-store artifacts, contracts/procurement, refining/downstream ops, HSE/compliance, logistics, capital projects, and corporate-governance materials
* Asking price reported in the thread: $800
* Listing observed September 27, 2026
No public confirmation from Ecopetrol establishing a successful intrusion, confirmed data theft, or that the offered archive is authentic has been identified.
⚠️ Analyst Note:
A national oil company filesystem dump of this scale would be high-impact if authentic — but a forum sale post is not proof of compromise. The $800 ask is unusually low relative to the claimed volume and sensitivity, which raises the possibility of exaggeration, recycled material, or an incomplete/misleading sample set. Treat victim naming, volume, category lists, and any implied credential exposure as an unverified threat-actor claim until Ecopetrol confirms an incident or independent evidence appears.
#DDW #DarkWeb #Ecopetrol #Colombia #OilAndGas #DataBreach #ThreatIntelligence #CyberSecurity