- The Gentlemen reportedly offered about 1 TB of alleged Ecopetrol data containing 327,095 files for $800.
- The listing may involve new material or data connected to the confirmed July cyberattack from Ecopetrol.
- Researchers still need to verify the size of the archive, contents, and authenticity before confirming the latest claim.
The ransomware group The Gentlemen has reportedly offered around 1 TB of Ecopetrol data for $800. The listing claims access to more than 327,000 files covering company operations, finances, human resources and IT systems.
The claim raises fresh questions because Ecopetrol already suffered a major cyberattack in July, this year. The company confirmed unauthorized data downloads at the time, but the new listing does not yet prove that attackers obtained a separate batch of information.
New Listing Raises Questions About Ecopetrol Data
A cybersecurity researcher reported the new listing on September 28. The post said The Gentlemen had placed approximately 1 TB of internal Ecopetrol data up for sale. The alleged archive contains about 327,095 files. The listed categories include operational records, financial information, HR and medical files, VPN and IT credentials, contracts and other internal material.
The reported asking price stands at only $800. That figure has drawn attention because the stated asking price is just $800. The value has raised doubts since the listed compromised dataset contains important pieces of corporate details.
Nonetheless, the advertisement itself does not serve as a proof of the authenticity of the material. In some cases, hacking groups give inflated information or use the materials from previous attacks.
The researcher also questioned whether the archive represents new data. Another possibility involves material stolen during the July incident and offered again.
That distinction matters because Ecopetrol already confirmed a serious data security incident in July. The company said an external actor gained unauthorized access to cloud-based file storage across roughly 15 group companies.
Ecopetrol reported that the attacker downloaded information linked to about 3,300 user accounts. The company also said its cybersecurity controls blocked the attempted ransomware attack.
July Attack Provides Important Context
The new claim follows a confirmed cyber incident that began on July 17. Ecopetrol said the attacker accessed certain digital resources and downloaded company data. The incident affected cloud storage environments connected to Ecopetrol and around 15 subsidiaries. The company said the attacker attempted to destroy, delete or encrypt information, but its security controls stopped those actions.
Ecopetrol also stated that their investigation did not show any impact of their transaction technology systems. Further, it reported no impact on any systems used by their subsidiaries, suppliers, customers, or partners. Ecopetrol later announced that an outside party had released stolen data from 15 of their allied companies.
To take the necessary steps to erase the information, Ecopetrol cooperated with the Ministry of Information and Communications Technologies of Colombia and with the Office of the Attorney General.
The Gentlemen claimed responsibility for that July attack. Security researchers have tracked the group as an active ransomware operation with victims across multiple countries. The Gentlemen has over 135 recorded claims of attacks in July. Moreover, Ecopetrol was among the victims of the claims that month and the company confirmed the underlying incident.
Therefore, the current listing could relate to the same stolen material. The available evidence does not establish whether the group has obtained another dataset since July.
Low Price Adds Another Unanswered Question
The reported $800 price creates another unusual part of the claim. A large archive containing corporate records, credentials and technical information could carry greater value to criminals than the asking price suggests.
Several explanations remain possible. The seller could offer the data cheaply to attract buyers quickly. The archive could also contain incomplete information or material that already appeared elsewhere.
Another possibility involves recycled data. Criminal groups can continue promoting previously stolen information after an initial extortion campaign.
Other ransomware-related claims have also involved large volumes of allegedly stolen corporate data, such as the hacker group claiming 100TB of Nayax data theft, threatening a July 21 leak.
The quality of the alleged files also remains unclear. A listing can state a file count without proving that every file contains useful or genuine information. The same issue applies to the claimed 1 TB size. Archive size does not show how much unique or sensitive information the files contain.
Consequently, researchers should analyze the samples in relation to those connected to the July event. They can also check file names, time of creation, hash values, and other technical indicators.
Meanwhile, those who purchase or otherwise acquire the stolen data pose additional threats. The stolen data can contain information about employees, contracts, and others.
The news about VPN and IT credentials raises another concern: whether the credentials are still valid. The previous report from the company about no violation of the personal data of 3,300 users concerning the affected accounts makes checking of the current statement even more important.
Ecopetrol Faces Continued Data Exposure Risk
Ecopetrol remains a major target because of its role in the energy sector of Colombia. The company operates extensive oil and gas infrastructure and manages information across multiple subsidiaries.
The July incident showed that attackers could steal data without successfully encrypting production systems. This type of attack can still create major pressure through data theft and extortion. The new listing could extend that pressure if it contains previously undisclosed information. It could also simply represent another attempt to monetize data already taken during the July breach.
Currently, there is limited data on which hypothesis is accurate. Ecopetrol has not confirmed whether the new archive implies a new breach. Therefore, the matter regarding the declared 327,095 documents and 1 TB of information needs to be treated as speculation. Additional proof may help determine if the data contains fresh information, recycled data, or inflated details.
Security personnel will most probably keep on watching the underground market for new messages. Also, they will check the new data against the findings of the July investigation. In addition, this case is characteristic of the bigger ransomware issue. The databases stolen from businesses may continue to be useful to criminals even after the company reported and contained the breach.
