Full analysis, recommended actions, tabletop scenarios, and cited sources in the complete issue.
INCIDENT · HIGH
Ecopetrol disclosed within hours. The data went up anyway.
Colombia’s state oil major was hit on 17 July and said so the same evening — unauthorised access to cloud file stores at around 15 group companies, data tied to roughly 3,300 user accounts downloaded, an attempted ransomware execution blocked before encryption completed. Two days later its technology VP added that files had been copied but neither deleted nor encrypted. On 28–29 July the company confirmed the attackers had published the material anyway, and said it was working with prosecutors and the technology ministry to have it taken down.
Why it matters: Ecopetrol did nearly everything the playbook asks — same-day disclosure, named scope, blocked encryption, criminal referral — and was published regardless, eleven days later. Against a crew whose product is publication rather than downtime, incident response decides whether you keep operating, not whether your files stay private. Fast disclosure buys regulatory standing and credibility. It does not buy leverage.
REGULATION · HIGH
The US cyber rule most foreign operators are preparing for does not currently bind their ships
33 CFR 101.605(b) says it in one line: the Coast Guard’s cybersecurity subpart “does not apply to any foreign-flagged vessels subject to 33 CFR part 104.” The US terminals those ships call at are fully inside it, working to a 16 July 2027 deadline for a Cybersecurity Officer, an assessment and a submitted plan. A separate rulemaking aimed at foreign-flagged vessels in US waters is expected around November 2026. Meanwhile the Coast Guard clarified on 22 July that an existing physical-security waiver does not carry over to cyber — those entities still owe an assessment first.
Why it matters: the exemption is real, temporary, and widely misread in both directions. Operators are either preparing for a rule that does not yet apply to them, or assuming the gap is permanent when a proposal is already queued. Both readings cost money. The window between now and the proposal is also the only period in which the industry gets to shape what gets proposed.
