In late April, it was revealed that USD 2.5 million from the government Treasury account was sent to bank accounts controlled by cybercriminals as a result of hacking during a foreign debt repayment to Australia in January. This was a part of a USD 22.9 million debt settlement.
The Committee on Public Finance (COPF) appointed to investigate the incident found that it was cyber fraud, its chairman Harsha de Silva, an opposition legislator, told parliament.
Tabling the committee's report, de Silva said, “The main recommendation in the report is that this was a fraud committed through a cyber crime. If there was an internal conspiracy to do so, it was not a matter that COPF can investigate”.
“We find that lapses at the governance level at both the Ministry of Finance and the central bank likely contributed to this fraud,” de Silva said.
Between November 2025 and January this year, the Treasury and the newly created Public Debt Management Office had processed several payments related to debt owed to Australia's export credit agency.
Later, between December and 20 March 2026, it came to be known that at least five debt payments totalling USD 2.5 million were sent to bank accounts controlled by cybercriminals instead of the Australian creditor as a result of hacking.
Sri Lanka became aware of hacking only in late March when Export Finance Australia informed authorities that the expected payment had not been received.
The police’s CID has reported the loss in court and investigations are ongoing. At least five Treasury officials were suspended in relation to the case.
An Assistant Director from the External Resources Department of the Finance Ministry, who was suspended in the case, was found dead under mysterious circumstances. Later, police said it was a case of suicide.
