Ecopetrol’s confirmed cyber incident shows how a seemingly limited theft of user-profile data can still create broader security concerns when identity records sit close to operational trust.