Sri Lanka’s 🇱🇰 Treasury Hack: What Is Confirmed So Far About the USD 2.5M Finance Ministry Breach

⭕ Sri Lanka’s 🇱🇰 Finance Ministry confirmed that cyber hackers breached the External Resources Department, the Treasury unit handling foreign-funded transactions and debt-related external payments.

⭕ The amount at the center of the case is USD 2.5 million, linked to a foreign-currency payment identified from January 2026. The missing funds were tied to a payment involving Australia 🇦🇺 and may have formed part of a USD 22.9 million external debt settlement.

⭕ Investigators believe intruders interfered with email-based payment instructions in the sovereign debt payment process, possibly by inserting or altering payment details and redirecting part of the Australia 🇦🇺-linked transfer away from the intended recipient.

⭕ Committee on Public Finance Chair Dr. Harsha de Silva has said Sri Lanka 🇱🇰 detected the missing USD 2.5 million only after the Australian creditor 🇦🇺 complained that the debt payment had not been received.

⭕ Dr. Harsha de Silva has also said the money was siphoned off in 5 tranches, indicating the loss may not have happened through a single transfer.

⭕ Deputy Finance Minister Anil Jayantha has said the fraud became clearer after a similar attempt linked to a payment due to India 🇮🇳 raised suspicion over changed account numbers in the payment details.

⭕ The case was reported to SL-CERT, the Police Computer Crime Investigation Division, the Criminal Investigation Department, and the Financial Intelligence Unit of the Central Bank of Sri Lanka, showing it had already escalated into a cybercrime and financial-intelligence investigation.

⭕ Disciplinary action was initiated against several officials, and the available information states that 5 officials were suspended: 2 Directors, 2 Deputy Directors, and the Head of the Computer Division.

⭕ The Public Debt Management Office (PDMO) became fully operational in December 2025, while the CBSL Public Debt Department ceased operations from January 1, 2026, after debt-management responsibilities were shifted into the new structure.

⭕ That means one of the earliest major debt-servicing episodes after Sri Lanka’s 🇱🇰 new debt-management handover ended with a cyber breach, missing funds, and suspended officials.

⭕ What is officially confirmed is narrower than some of the reporting: the breach happened, money linked to the transaction was stolen, and both criminal and internal investigations are underway.

⭕ The biggest unanswered questions are the exact attack path, how the payment controls failed, whether the funds can be recovered, and whether the case affects Sri Lanka’s 🇱🇰 sovereign payment credibility.

#SriLanka