Sri Lankan law enforcement agencies have launched an investigation into a cyber heist that resulted in the theft of $2.5 million from the country’s Ministry of Finance. The incident occurred in January 2026 during an external debt payment to an Australian creditor.
Harshan Suryaperum, head of the department, stated at a press conference in Colombo: “Hackers interfered with communication and managed to redirect funds. Law enforcement agencies are investigating whether the attacks were conducted locally or from outside Sri Lanka.”
Attackers gained unauthorized access to government systems, intercepted email correspondence between the Treasury and the Australian export finance agency, and replaced bank details in payment instructions. The criminals were detected when they attempted a second theft using information related to a payment to India.
The theft took place amid Sri Lanka’s recovery from a default triggered by damage from a cyclone in November 2025, an energy crisis, and ongoing geopolitical tensions between the United States and Iran.
