Cybercriminals infiltrated Sri Lanka’s treasury email system and diverted approximately $2.5 million meant to repay a foreign debt, sparking calls for a thorough independent inquiry.
The breach, which targeted the Public Debt Management Office, involved hackers intercepting government communications and redirecting payments intended for Australian export finance agencies. Funds were transferred in five installments between December 2025 and March 2026, but the scam was only discovered when Australian officials notified Colombo that the money had not arrived.
Treasury Secretary Harshana Suriyapperuma acknowledged the fraud, stating that while proper procedures were followed, the criminals intercepted email exchanges and rerouted the funds to unauthorized accounts.
The incident has triggered sharp criticism from opposition lawmakers, who accuse the government of hiding the breach from parliamentary oversight. Harsha de Silva, head of the parliamentary Committee on Public Finance, expressed outrage over the lack of transparency, noting that parliament holds constitutional authority over public finances.
Suriyapperuma defended the decision not to inform legislators immediately, arguing that doing so could have hindered ongoing criminal investigations. He confirmed that several finance officials have been suspended as the probe continues, though he declined to disclose where the stolen money was sent.