EC · Ecopetrol S.A.

The filing updates investors on a cybersecurity incident first disclosed in early July 2026. An external actor has now published illegally copied information from 15 subsidiaries of the Ecopetrol Group. The company is actively collaborating with Colombian law enforcement, including the Cybercrime Unit of the Office of the Attorney General and the Ministry of Information and Communications Technologies, to have the data removed from public access and to pursue legal action against the perpetrator. Crucially, Ecopetrol confirms that its transactional technology solutions, those of its subsidiaries, and its partner network (including suppliers and customers) have not been compromised. However, the company cautions that the full scope, impact, and costs of the incident are still uncertain and that it could lead to regulatory proceedings, litigation, reputational harm, or other material adverse effects. Investors should monitor further disclosures as the investigation progresses.