Cyber criminals hacked into the Sri Lankan finance ministry’s computer system and siphoned off $2.5 million, the government said on Thursday, the most amount of cash ever stolen by hackers from a state institution in the debt-saddled country.
The cyberattack is a major blow to Sri Lanka, which is recovering from a crippling economic crisis in 2022 after Colombo defaulted on its $46 billion external debt.
The money was destined as debt repayment to Australia, finance ministry secretary Harshana Suriyapperuma told reporters in the capital.
Four senior officers at the Public Debt Management Office (PDMO) were suspended after the breach, he said.
Authorities were alerted to an attempt to break into the ministry’s e-mail server, and investigations showed that a $2.5 million payment owed to Australia had disappeared.
“Criminal investigators are looking into this and we are not in a position to give further details,” Suriyapperuma said, adding that Sri Lankan authorities were seeking help from foreign law enforcement agencies.
Sri Lanka established the PDMO earlier this year in line with an IMF-backed $2.9 billion bailout loan from early 2023, following the island’s economic meltdown.
Australia’s High Commissioner in Sri Lanka, Matthew Duckworth, said Canberra was aware of “irregularities” in payments owed to it.
“Sri Lankan authorities are investigating the matter and are coordinating with Australian officials, who are assisting the investigation,” Duckworth said on X.
“Australia remains committed to supporting Sri Lanka’s return to debt sustainability.”
The attack came as Sri Lanka’s central bank and finance ministry launched an advertising blitz in local newspapers earlier this year, warning Sri Lankans not to fall prey to cyber scams.
