{"filing":{"accession_number":"0001292814-26-003818","cik":"0001444406","ticker":"EC","company_name":"ECOPETROL S.A.","form":"6-K","filing_date":"2026-07-20","report_date":null,"primary_document":"ec20260720_6k.htm","primary_document_url":"https://www.sec.gov/Archives/edgar/data/1444406/000129281426003818/ec20260720_6k.htm"},"events":[{"id":18893,"run_id":16992,"accession_number":"0001292814-26-003818","anchor_item_number":"EX-99.1","event_type":"cybersecurity_incident","event_domain":"legal","is_material":true,"confidence":0.95,"summary":"This exhibit is a disclosure of a material cybersecurity incident at Ecopetrol, a critical national infrastructure operator. The incident involved unlawful infiltration of 3,300 accounts and downloading of files, with extortion demands from the threat actor. Although the company states no compromise to data integrity or user credentials occurred, the incident is material given Ecopetrol's critical infrastructure status, the scale of affected accounts, ongoing extortion threats, and active collaboration with Colombian government cybersecurity agencies (ColCERT, CCOCI, DIJIN). The disclosure directly addresses the cybersecurity incident previously disclosed on July 17, 2026.","company_name":"ECOPETROL S.A.","ticker":"EC","filing_date":"2026-07-20","form":"6-K","submitted_at":null,"items":[{"id":17842,"accession_number":"0001292814-26-003818","item_number":"EX-99.1","item_title":"ex99-1.htm","event_type":"cybersecurity_incident","event_domain":"legal","is_material":true,"confidence":0.95,"reasoning":"This exhibit is a disclosure of a material cybersecurity incident at Ecopetrol, a critical national infrastructure operator. The incident involved unlawful infiltration of 3,300 accounts and downloading of files, with extortion demands from the threat actor. Although the company states no compromise to data integrity or user credentials occurred, the incident is material given Ecopetrol's critical infrastructure status, the scale of affected accounts, ongoing extortion threats, and active collaboration with Colombian government cybersecurity agencies (ColCERT, CCOCI, DIJIN). The disclosure directly addresses the cybersecurity incident previously disclosed on July 17, 2026.","classifier_version":"claude-haiku-4-5-20251001+prompt-6be895f9","taxonomy_version":"v1.3","classified_at":"2026-07-21T10:02:01.049363+00:00","company_name":"","ticker":null,"filing_date":""}]}],"classifications":[{"id":17842,"accession_number":"0001292814-26-003818","item_number":"EX-99.1","item_title":"ex99-1.htm","event_type":"cybersecurity_incident","event_domain":"legal","is_material":true,"confidence":0.95,"reasoning":"This exhibit is a disclosure of a material cybersecurity incident at Ecopetrol, a critical national infrastructure operator. The incident involved unlawful infiltration of 3,300 accounts and downloading of files, with extortion demands from the threat actor. Although the company states no compromise to data integrity or user credentials occurred, the incident is material given Ecopetrol's critical infrastructure status, the scale of affected accounts, ongoing extortion threats, and active collaboration with Colombian government cybersecurity agencies (ColCERT, CCOCI, DIJIN). The disclosure directly addresses the cybersecurity incident previously disclosed on July 17, 2026.","classifier_version":"claude-haiku-4-5-20251001+prompt-6be895f9","taxonomy_version":"v1.3","classified_at":"2026-07-21T10:02:01.049363+00:00","company_name":"ECOPETROL S.A.","ticker":"EC","filing_date":"2026-07-20"}]}