Hackers divert $2.5 million of Sri Lanka's debt repayment to Australia

On 23 April 2026, Sri Lanka's Ministry of Finance confirmed that cybercriminals had diverted about $2.5 million that was meant for a government-to-government debt repayment to Australia. Finance Ministry Secretary Harshana Suriyapperuma said attackers had infiltrated computer systems of the ministry's External Resources Department and intercepted email communications about the payment. By altering the payment details, they sent the money to other bank accounts.

According to the ministry, the breach took place in late 2025 and the intrusion was discovered in January 2026. Reporting indicated the theft came to light after Australia flagged that it had not received the expected payment. Australia's High Commissioner, Matthew Duckworth, said Australian officials were aware of the payment irregularities and were helping with the investigation.

Investigation and response

The ministry notified the Sri Lanka Computer Emergency Readiness Team (SL-CERT), the Computer Crimes Investigation Division, the Criminal Investigation Department, the Central Bank's Financial Intelligence Unit and the Australian High Commission. An internal committee led by two Deputy Secretaries to the Treasury was appointed, disciplinary action was taken against certain officials, and senior officers of the Public Debt Management Office were suspended. The ministry said it had kept the case confidential until then so as not to obstruct investigators or alert the criminals.

Why it matters

The case is described as the largest cyber theft recorded from a Sri Lankan state institution. It hit a country still restructuring its debt after its 2022 default, and it shows that business email compromise, more often associated with companies and suppliers, can also target sovereign payments between governments when payment instructions are confirmed by email alone.