Sri Lanka Central Bank Tricked Into Paying $2.5M to Cyber Criminals

Hackers breached the email system of Sri Lanka’s Public Debt Management Office and manipulated communications to divert approximately $2.5M in debt repayments sent in five installments between Dec 31, 2025 and Mar 20, 2026; the theft was discovered after Australian export finance agencies reported non-receipt. The Ministry of Finance confirmed the diversion, several finance officials have been suspended, and opposition lawmakers are demanding an independent investigation amid criticism that the government withheld information from parliament.