Hackers stole over $3 million from the Sri Lankan government's systems

Unidentified hackers reportedly stole more than $3 million from the Sri Lankan government in two separate incidents by intercepting and diverting outbound payments to their accounts.

 

The Ministry of Finance said it had launched an investigation into the disappearance of $2.5 million that, according to the government’s knowledge, had been paid to Australia as part of a debt repayment programme.

 

Australia never received the funds, and subsequent investigations revealed that the money had been intercepted and diverted by malicious actors, said finance ministry secretary Harshana Suriyapperuma to the local press.

 

He added that the finance ministry suspended four senior officers at the Public Debt Management Office and law enforcement authorities have launched criminal investigations into the cyber crime incident.

 

The Ministry said in a press release that the foreign currency payment was made in January this year but did not say when the theft was discovered. It said the theft was committed by hackers who breached the computer systems of the External Resources Department of the Ministry of Finance, Planning and Economic Development.

 

"Based on identified information relating to a foreign currency payment in January 2026, the Ministry of Finance, Planning and Economic Development informed the Sri Lanka Computer Emergency Readiness Team (SL-CERT) and the Computer Crime Investigation Division of the Sri Lanka Policе," the minstry said.

 

"Based on the investigations carried out, a complaint was subsequently lodged with the Criminal Investigation Department (CID) and the Financial Intelligence Unit (FIU) of the Central Bank," it added. "A preliminary internal inquiry has also been conducted in this regard, necessary actions have been taken, and disciplinary actions have been initiated against several officials."

 

On April 28, Newswire Lanka reported that the Sri Lankan government is urgently investigating another reported theft of $625,000 that it sent to the U.S. Postal Service. 

 

"Sri Lanka has made the payment, but the U.S. Postal Service has informed us that it has not received the funds," said Minister Nalinda Jayatissa, adding that the Criminal Investigation Department and the Department of Posts are conducting parallel investigations into the alleged theft.

 

The minister did not state whether the two incidents of theft were carried out by the same actor. "I cannot comment that if it is linked to this incident, but I can say that there is an ongoing investigation," he added.