Sri Lanka’s Finance Ministry has confirmed that cybercriminals hacked into its computer system and siphoned off US$2.5 million, marking the largest theft ever recorded from a state institution in the debt-stricken country.
The government said the money, which was intended for debt repayment to Australia, was diverted following the cyber intrusion. Finance Ministry Secretary Harshana Suriyapperuma said the incident represents a serious setback as the country continues its recovery from the 2022 economic crisis, when it defaulted on US$46 billion in external debt.
Authorities revealed that the breach involved an attempted intrusion into the ministry’s email server. Investigations later found that a scheduled US$2.5 million payment to Australia had gone missing.
In response to the incident, four senior officials from the Public Debt Management Office (PDMO) have been suspended while investigations continue. Suriyapperuma said criminal investigators are actively probing the case, and Sri Lanka is also seeking assistance from foreign law enforcement agencies.
Australia has acknowledged the situation, with High Commissioner Matthew Duckworth stating that Canberra is aware of “irregularities” involving payments due to it. He added that Australian authorities are working with Sri Lankan officials to support the investigation, while reaffirming Canberra’s commitment to helping Sri Lanka achieve debt stability.
The PDMO was only established earlier this year as part of reforms linked to a US$2.9 billion International Monetary Fund bailout package secured in 2023 following Sri Lanka’s financial collapse.
The cyberattack comes amid heightened efforts by Sri Lankan authorities to raise public awareness on digital fraud, including recent nationwide warnings against cyber scams issued by the central bank and finance ministry.
