Sri Lanka Launches Probe After Hackers Steal $2.5 Million in Debt Payment

COLOMBO. Sri Lanka has launched a comprehensive investigation into a cyberattack where hackers infiltrated the Ministry of Finance's computer system, stealing approximately $2.5 million. Officials stated the funds were part of a bilateral debt repayment to Australia, scheduled for settlement in September 2025. It is believed that cybercriminals intercepted the transaction around January, diverting the funds to unauthorized bank accounts. The incident has only recently been made public.

“Although Sri Lanka had made the designated payment, cybercriminals intervened, preventing the funds from reaching the intended recipient and diverting them to other accounts,” Finance Ministry Secretary Harshana Suriyapperuma told the media on Thursday. Following the incident, four senior officials from the Public Debt Management Office have been suspended. The exact method of the theft remains unclear, and assistance has been sought from foreign law enforcement agencies.

Investigators suspect that hackers may have manipulated payment instructions sent via email. The incident came to light only after the Australian side reported not receiving the funds. Deputy Finance Minister Anil Jayantha Fernando noted that further suspicion arose after another payment intended for India was also found to have been altered. Authorities are currently investigating why security mechanisms failed and the possibility of recovering the stolen funds.

This cyberattack serves as a significant blow to Sri Lanka as the country continues to recover from the severe economic crisis of 2022. At that time, a depletion of foreign currency reserves left the government unable to import food, fuel, and medicine, leading to widespread public protests that eventually ousted then-President Gotabaya Rajapaksa.

Australian High Commissioner to Colombo, Matthew Duckworth, confirmed that they were informed of the irregularities regarding the payment due to Australia and are cooperating with the investigation. Amidst this incident, the Central Bank of Sri Lanka and the Ministry of Finance have been conducting a campaign urging citizens to remain vigilant against cyber fraud.