US$ 2.5 mn cyber theft: Sri Lanka wakes up only after Australia alerts

Colombo, April 30 (Daily Mirror) - Sri Lankan authorities became aware of a US$ 2.5 million cyber theft only after Australian authorities flagged a delay in a debt servicing payment owed to them, an opposition MP familiar with the process said, raising serious concerns about systemic lapses in financial oversight.

The Committee on Public Finance (COPF) is expected to question Finance Ministry Secretary Dr. Harshana Suriyapperuma today, after summoning him to appear before the committee at the Parliamentary complex.

New Democratic Front (NDF) MP Ravi Karunanayake, a member of COPF, told Daily Mirror that five payments had fallen due—three in November last year and two in January this year—relating to interest payments on a bilateral loan instalment amounting to US$ 22.9 million.

“The Australian authorities questioned the delay in settlement. Only then did the government realise that something had gone wrong,” he said.

The disclosure points to a troubling gap in internal detection mechanisms, with the breach going unnoticed until an external creditor raised a red flag—effectively exposing vulnerabilities in Sri Lanka’s financial control architecture at a time when debt servicing remains under intense global scrutiny.

Karunanayake further argued that the Central Bank of Sri Lanka should also bear responsibility, noting that three of the disputed transactions occurred when the Public Debt Department (PDD) was still under its purview.

The Central Bank had earlier announced the closure of its Public Debt Department (PDD) and the transfer of its LankaSecure division to the Payments and Settlements Department, effective January 1, 2026. This restructuring followed the establishment of the Public Debt Management Office (PDMO) under the Finance Ministry, in line with the Public Debt Management Act No. 33 of 2024.

Investigations into the cyber heist are now underway, with assistance from the Australian Federal Police.