Cyber theft raises questions about Government competence and commitment to transparency

• Post-Avurudu blow for ruling NPP as Lanka loses US$2.5 million to hackers; opposition demands Treasury Secretary’s resignation
• Government appoints expert committee to study Easter Sunday report recommendations; Cardinal endorses probe’s progress
• Indian Vice President Radhakrishnan holds top-level meetings in Sri Lanka with political leaders, urges Tamil parties to unite

By our Political Desk ST 26-04-2026

The new year hasn’t got off to an auspicious start for the ruling National People’s Power (NPP). Barely had the government managed to distract the public from the scandal over the import of substandard coal when it was hit by a worse scandal — the breach of the Finance Ministry’s computer systems, which resulted in a payment of USD 2.5 million to hackers.

A party that insisted it was the one hope to end the “76-year curse” plaguing the country due to the corrupt governance of those who held power since Independence, has now found itself mired in scandals similar to those that engulfed its predecessors. Moreover, the NPP’s responses to those scandals are looking ever more similar to the responses adopted by its predecessors in government as well. Therein lies the supreme irony of it all.

This week’s stunning admission by the Finance Ministry that hackers had breached its computer system and siphoned off USD 2.5 million is just the latest scandal to hit the NPP administration. The revelation made global headlines and caused enormous embarrassment to both the government and the country as a whole. According to a statement released by the Finance Ministry on Wednesday, the hackers had breached the computer system of its External Resources Department. “Based on identified information relating to a foreign currency payment in January 2026, the Ministry of Finance, Planning and Economic Development informed the Sri Lanka Computer Emergency Readiness Team (SL-CERT) and the Computer Crime Investigation Division of the Sri Lanka Police. Based on the investigations carried out, a complaint was subsequently lodged with the Criminal Investigation Department (CID) and the Financial Intelligence Unit (FIU) of the Central Bank,” the statement said. It added that a preliminary internal inquiry was also conducted, and disciplinary actions have been initiated against several officials.

There is no question that the loss of USD 2.5 million in Treasury funds is a severe blow to a country that is still struggling to recover from a crippling economic crisis.

The Treasury’s acknowledgement came after the opposition-aligned Free Lawyers’ Association, led by President’s Counsel Maithri Gunaratne, wrote to Speaker Jagath Wickramaratne informing him of the cyber-theft and calling on Parliament to initiate a comprehensive investigation. The association had come to know of the theft after the Finance Ministry appointed a Technical Investigation Committee headed by two deputy secretaries of the Treasury on March 24 to probe fraudulent email communications and the missing bilateral payment of USD 2.5 million associated with the Australian agreement.

“The Australian High Commission and Sri Lanka’s Ministry of Finance are aware of irregularities in payments owed to the Australian Government. Sri Lankan authorities are investigating the matter and are coordinating with Australian officials who are assisting the investigation. Australia remains committed to supporting Sri Lanka’s return to debt sustainability,” the Australian High Commission said in a statement after the Finance Ministry issued its statement acknowledging the incident.

Both Deputy Finance Minister Anil Jayantha Fernando and Treasury Secretary Harshana Suriyapperuma also addressed the media regarding the incident – the former via a video statement and the latter during a press conference convened to brief the media on the issue. Deputy Minister Fernando explained that the incident had occurred during email communications with the Australian Export Finance Agency regarding a settlement of funds. Hackers had gained access to these email communications. He said the theft came to light after hackers tried to also obtain funds linked to a payment due to India when officials became suspicious after changes were made to account numbers. He defended the Finance Ministry’s handling of the incident, including the move to withhold details of the theft from the media, saying divulging such information could indirectly aid the hackers. During his press conference, Treasury Secretary Suriyapperuma also offered few answers, repeatedly saying he could not go into specific details of the incident but would speak on the matter broadly given that divulging specifics could negatively impact ongoing investigations.

“We have to acknowledge that this (theft) occurred due to the negligence of our officials,” a senior Treasury official told the Sunday Times. He wished to remain anonymous because he was not authorised to discuss the ongoing investigations. He noted that the incident involved officials from both the Public Debt Management Office (PDMO) and the External Resources Department (ERD). The true extent of the theft only became apparent in March, as investigators traced back email communications from earlier fund transfers following the detected attempt to divert funds meant to India, the source said. While the Finance Ministry could have made a public statement earlier revealing the cyber-theft, the official claimed the decision to not make the incident public was taken following advice from various local and international financial and investigation agencies involved in the probe, as making such a statement would have alerted the hacker or hackers that authorities were probing the matter. “They may have been still in our systems, thinking the theft had gone undetected. This would give investigators more time to try to trace them. As such, we were advised not to make any official announcements and let investigations continue.”

Investigators believe that the cybercriminals had used a tactic known as ‘Business Email Compromise’ (BEC), where they had targeted a PDMO official who had gone on maternity leave. Her email communications had been compromised, and the hackers had manipulated them into convincing Treasury officials they were from the Australian agency.

At one point, however, some of the funds had not gone through and had been returned. The Treasury had referred the matter to the Central Bank of Sri Lanka (CBSL), which in turn had got in touch with the Australian bank to which the hackers, impersonating the Australian agency, had asked the funds to be deposited. The bank had informed CBSL that it had detected suspicious activity related to this account, specifically regarding money laundering. The CBSL had then conveyed the information to the Treasury. This incident should have raised immediate red flags, the sources noted. Yet, the Treasury officials responsible had then emailed those posing as the Australians and inquired about the matter from them, notifying them of the funds being returned. They had received an “apology” saying a mistake had been made at their end, with instructions to deposit the funds in a new bank account, which the officials had duly complied with. “The fact that those responsible did not think to reach out to the bank or the Australian High Commission when suspicious activity had been flagged is truly astonishing,” the official observed.

Investigators believe that the USD 2.5 million that was stolen had been diverted to bank accounts in Dubai. As of yesterday, at least four Treasury officials had been suspended over the matter following an internal probe. The Criminal Investigation Department (CID), which is conducting its own inquiry, will also be looking at whether the incident was solely the result of hackers managing to compromise emails within the Treasury or whether they also had help from inside. A senior CID officer said they had already recorded statements from several Treasury officials in relation to the investigation.

Opposition parties have demanded answers regarding the cyber-theft. Opposition Leader Sajith Premadasa told the media that the government was yet to offer a proper explanation regarding how a hacker or hackers had managed to steal USD 2.5 million from the country’s Treasury. He claimed Treasury Secretary Suriyapperuma and Deputy Minister Fernando were giving two different versions of what happened. “If this attempt was detected in January, why did they wait till March to appoint a committee to investigate it? Why wasn’t Parliament, which has responsibility for public finances, made aware of the incident?” he queried.

Others in the opposition also noted that the incident had occurred just after the PDMO under the Treasury had taken over debt management functions previously carried out by the CBSL’s Public Debt Department (PDD). The PDMO was established under the Public Debt Management Act No. 33 of 2024 in December 2024 and became fully operational in December 2025. “This is not just negligence. This is a failure we warned about,” Samagi Jana Balawegaya (SJB) MP and Parliament’s Public Finance Committee (COPF) chairman Harsha De Silva wrote on X, referring to the theft of USD 2.5 million from the Treasury. He stressed that when debt operations were moved from the CBSL to the Treasury’s PDMO, the COPF repeatedly urged the Treasury to hire competent, experienced staff. “Managing a sovereign nation’s debt in global financial markets is not a clerical task. Those warnings were ignored,” he alleged. The COPF chairman added that this comes as Finance Ministry officials have failed to appear before COPF for three consecutive meetings: on gaming regulation, Q4 2025 fiscal performance, and the critical discussion on fiscal-monetary policy coordination. He added that in over 15 years in Parliament “I have never seen this level of contempt for parliamentary oversight.”

“The reported loss of USD 2.5 million through fraudulent payment instructions is not a minor administrative lapse; it is a serious breakdown of oversight, internal controls, and institutional safeguards within the Treasury,” said Sri Lanka Podujana Peramuna (SLPP) National Organiser Namal Rajapaksa on his X account. He added that when systems fail at the top, junior officers should not be turned into sacrificial lambs to shield those responsible for supervision and decision-making. “If inexperienced officials were placed in sensitive technical roles without proper protection, the fault lies with those who designed the system, not those left exposed by it.”

In the wake of the loss of USD 2.5 million in state funds, there have been growing calls for Treasury Secretary Suriyapperuma to step down from his position. His critics point out that there have been serious concerns regarding him ever since his appointment, noting that Dr Suriyapperuma was earlier an NPP MP and the Deputy Minister of Finance before resigning to take up the post of Treasury Secretary. The opposition has insisted that this was a case of blatant politicisation of the position of Treasury Secretary by the NPP government.

Some in the opposition have also raised questions about possible government involvement in the theft of USD 2.5 million. Former ministers such as Wimal Weerawansa and Udaya Gammanpila have refused to buy the government’s claim that hackers had siphoned off the Treasury’s funds overseas, claiming the NPP itself. “The hacker is the Treasury Secretary,” claimed Mr Weerawansa during a media briefing, while Mr Gammanpila claimed there was “reasonable suspicion” that the bank account where the funds ultimately ended up could be connected to the Pelawatte NPP head office.

It has also been pointed out that President Anura Kumara Dissanayake cannot escape blame for the fiasco, given that he is also the Minister of Finance. This week’s revelations have also led to calls for him to sack Treasury Secretary Suriyapperuma and for him to hand over Finance Minister duties to someone else.

There is no question that the loss of USD 2.5 million in Treasury funds is a severe blow to a country that is still struggling to recover from a crippling economic crisis. The government may claim it was forced to stay silent so as not to disrupt ongoing investigations, but the fact that the Finance Ministry only acknowledged a historic theft of such magnitude after it was exposed by the opposition casts the government in a severe negative light. What would have happened had the Treasury’s letter appointing a technical committee to investigate the theft not leaked out? How many months more would the government have kept the country in the dark about such a calamity?

The theft also makes a mockery of the NPP government’s drive to enact a digital transformation of the country. If hackers, as the government admits, are able to compromise email communications in the country’s Treasury and siphon off millions in taxpayer funds, what does that say of the state’s cybersecurity defences?

The government’s responses to the scandal show a familiar pattern – blame public officials while insisting the government itself is innocent. The response to the controversy surrounding the low-quality coal procured by Lanka Coal Company for the Lakvijaya Coal Power Plant in Norochcholai has followed a similar pattern. While the government, when confronted with evidence, was forced to admit that the South African coal supplied by India’s Trident Chemphar was of low quality, it insisted there had been no fraud or corruption in the controversial tender process whereby Trident was awarded the contract. The recent special audit report by the National Audit Office (NAO) into the coal purchase process of the Lakvijaya plant and coal procurement for the 2025/2026 season, however, has cast doubt on the government’s claims.

Despite allegations that the coal procurement process had been tainted by corruption, the NPP government had earlier chosen to back Energy Minister Kumara Jayakody when the main opposition Samagi Jana Balawegaya (SJB), backed by other opposition parties, submitted a No-Confidence Motion against him. The NPP used its 2/3 majority in Parliament to steamroll the NCM by a majority of 104 votes.

Minister Jayakody and Power Ministry Secretary Udayanga Hemapala did resign on April 17 after President Dissanayake appointed a Presidential Commission of Inquiry to probe all coal procurements for electricity generation since 2009 to April 16, 2026. The government, though, is acting as if the Commission will exonerate Mr Jayakody even before it has sat for its first sitting. So it was that the public was treated to the rather bizarre spectacle of Mr Jayakody being present when Anura Karunathilake assumed duties as the new minister of energy this week.

Meanwhile, the NPP government, which had hailed the Auditor General’s reports when in the opposition and used such reports frequently to highlight instances of fraud and corruption by previous governments, now seems to be singing a different tune when such reports paint their own actions in a negative light. Ministers such as Wasantha Samarasinghe are now going on political talk shows to dispute findings in the special audit report on 2025/2026 coal procurements for Lakvijaya.

Opposition members on the Parliamentary Select Committee (PSC) probing the release of 323 containers from Colombo Port without subjecting them to a mandatory physical inspection this week sought to call four further witnesses before the committee to provide statements. They included President Dissanayake in his capacity as Minister of Finance (Sri Lanka Customs comes under the Finance Ministry) and then Ports and Civil Aviation Minister Bimal Rathnayake. The opposition PSC members, however, accused the government of using its majority in the committee to call for a vote on summoning the four witnesses and defeated the proposal.

Easter Sunday attacks

Amidst these crises, as the country marked the seventh anniversary of the Easter Sunday terrorist attacks, there must have been a sigh of relief from the government when Colombo’s Archbishop Malcolm Cardinal Ranjith publicly endorsed the inquiries into the April 21, 2019 bombings which largely targeted the Christian community in the country.

In a message issued ahead of the seventh anniversary of the bombings, the Cardinal said that ‘after repeated pleas by the Catholic Church, now at last, the incumbent government and the security establishment seem to be holding a credible inquiry into this episode of mass murder in order to find out who was really behind it.”

He expressed similar sentiments at the main commemorative service held at the St Anthony’s Shrine in Kochchikade, Colombo, one of the churches attacked by the suicide bombers.

However, he voiced concerns that there were ongoing efforts by various forces to derail credible inquiries into the attacks that claimed 278 lives and left nearly 500 injured and brought up the absence of the elusive ‘mastermind’ behind these attacks.

“And there are many forces actively seeking to obstruct these inquiries and divert the direction of the inquiry in an aimless fashion to hide the truth behind these attacks. They are nothing but the agents of the devil who wish to hide the truth behind a wall of political posturing. Let us stand together firmly behind the efforts to find out the truth. Let us not be deceived by attempts of different people to hide the truth or divert attention in all kinds of directions in order to confuse the public,” he said in the message to mark the day.

On Thursday the State Intelligence Service’s former chief, Suresh Salley, currently being held under the Prevention of Terrorism Act (PTA) due to his alleged links to the Easter Sunday attacks, was produced before Fort Magistrate Isuru Nettikumara. His detention was extended till May 20.

Meanwhile, the cabinet this week approved a proposal by President Anura Kumara Dissanayake to appoint a committee comprising an expert in the field of counter-terrorism and national security along with the representatives of the relevant ministries and institutes to oversee the implementation of the recommendations of the report submitted by the Presidential Commission of Inquiry on the Easter Sunday Attacks and the then-sectoral oversight committee on national security. The expert committee will function under the supervision of the Presidential Secretariat.

The decision to appoint the committee was taken due to the absence of a systematic, formal, and sustainable mechanism to monitor the implementation of the recommendations.

Indian VP’s visit to Sri Lanka

This week, there was another high-profile visit by an Indian dignitary to Sri Lanka. Vice President C.P. Radhakrishanan arrived in Sri Lanka on Sunday, but the timing of the two-day visit—days before the State Assembly polls in his home state of Tamil Nadu—led to speculation that his visit was aimed at winning support from some voters who have an eye on development with regard to Tamil issues in Sri Lanka.

During his stay, Mr Radhakrishnan met leaders of political parties from the North and East and those representing the Indian-origin Tamil community, thus reinforcing India’s commitment to the welfare of the Tamil community in Sri Lanka.

When Mr Radhakrishnan met representatives of Tamil political parties in the Northern and Eastern provinces, he had a pertinent question for them: Why are there so many Tamil political parties? Those representatives of Tamil political parties had no answer.

The Indian vice president’s question was meant to address the lack of unity among the Tamil political parties and the recent rise in breakaway parties, mainly from the grand old Tamil party, Ilankai Thamil Arasu Katchchi (ITAK).

Ex-Parliamentarian S. Kajendran of Tamil National Peoples’ Front (TNPF) also attended the meeting. The meeting took place at the Taj Samudra hotel on Sunday at 2.30 pm.

ITAK’s acting chairman C. V. K. Sivagnanam and elected leader S. Shritharan were present at the meeting. Due to an ongoing legal battle challenging the election at the last party conference, Mr Shritharan is unable to fulfil his duties as party leader.

Vice President Radhakrishnan pointed out the number of parties in Tamil politics and asked us to unite under a single banner. Nowadays, there are so many parties coming up in the districts. Sometimes we don’t know how many parties are out there. The situation is not healthy for Tamil politics. That was the message from him,” Mr Sivagnanam said.

Besides this, the party, as usual, raised the postponement of Provincial Council elections and the resolution of the Tamil national question in the new Constitution-making process under a federal structure. This has been the longstanding demand of Tamil parties whenever they meet visiting Indian dignitaries.

“He informed us that he had taken up the issue of the pending PC polls during his meeting with President Dissanayake.”

Speaking to the media about the meeting, TNPF leader Kajendrakumar Ponnambalam told reporters that his party’s representative told the Indian Vice President that his party is committed to carrying out an awareness campaign in the South on a federal-based solution to the national question since misconceptions were being spread.

“We have been demanding a just and lasting federal-based solution to the Tamil question for decades. Just because people in the South are concerned that the country will be divided if a federal solution is reached, we are not willing to give up our demands,” the MP said.

Mr Radhakrishnan’s Sri Lanka tour kicked off with a meeting with President Dissanayake at the Presidential Secretariat in Colombo, where the two leaders reviewed ongoing bilateral initiatives, including the progress of various development cooperation projects being undertaken by India in Sri Lanka. One important decision taken by Sri Lanka was to join the India-led International Big Cat Alliance. Prime Minister Narendra Modi launched the International Big Cat Alliance (IBCA) for global conservation of seven big cats, namely tiger, lion, leopard, snow leopard, cheetah, jaguar and puma, in 2023 and has 17 member nations at present.

The Indian VP was hosted to a luncheon by Prime Minister Harini Amarasuriya. The two leaders recalled the deep bonds between India and Sri Lanka and the vibrant people-to-people connections that keep these bonds alive. The two leaders also noted with satisfaction the announcement regarding the enhancement of the scope of support under the Ceylon Estate Workers Education Trust (CEWET) Scholarship Scheme. The number of scholarships has been increased from 350 to 700, and the monthly stipend has been increased to LKR 2500 for A-Level students and LKR 7500 for those pursuing higher education, benefiting the children of estate workers.

He also held a meeting with Opposition Leader Sajith Premadasa in Colombo.

Mr Radhakrishnan also addressed around 1000 members of the Indian diaspora at a community reception at the New Kathiresan Hall in Colombo. At the event, he announced the extension of OCI Card eligibility to include 5th and 6th generation Indian-origin Tamils (IOTs) in Sri Lanka, from the existing condition of up to the 4th generation. The Overseas Citizen of India (OCI) card will grant them the ability to travel to India visa-free and live and work there. VP Radhakrishnan also announced the simplification of the OCI process by providing recognition to certificates issued by the Government of Sri Lanka as proof of nativity.

Mano Ganeshan, leader of the Tamil Progressive Alliance (TPA), one of the main political parties representing Sri Lankans of Indian origin, welcomed and thanked the Indian Prime Minister for the forward-looking initiative of easing the Overseas Citizen of India (OCI) process for the eligible Sri Lankans. He said the decision is a significant step forward, addressing long-standing anxiety around eligibility and documentation. “The acceptance of GoSL-issued records confirming Indian ancestry & extending lineage recognition up to six generations has materially improved accessibility, making OCI status more attainable than ever before,” Mr Ganeshan said in a message on his X account.

The other items on the Indian dignitary’s itinerary included a visit to houses constructed under the Indian Housing Project at the Liddlesdale Estate at Ragala in the Nuwara Eliya district of Sri Lanka and a visit to the Seetha Amman Temple. This key location, associated with the Ramayana, is where Sita is believed to have been held captive by the king of Lanka, Ravana.

In addition to the announcements on OCI Cards, completion of Phase-III of the Indian Housing Projects, resumption of train services on the restored Northern Railway Line, installation of 3 Bailey Bridges and expansion of the CEWET Scholarship, and Sri Lanka deciding to join the India-led International Big Cat Alliance, the following MoUs were also exchanged during the visit:

One was a Memorandum of Understanding (MoU) on the first set of six priority projects under the Multi-Sectoral Grant Assistance for the Eastern Province, and the other was an MoU for the construction of a four-storey Medical Ward Complex at District General Hospital in Mullaitivu.

The Indian VP also paid his respects at the Kathiresan Temple and the Gangaramaya Temple, where the Holy Relics of Lord Buddha from Devnimori in Gujarat were on display in February.

He was accompanied by Prof. S.P. Singh Baghel, Minister of State in the Ministry of Fisheries, Animal Husbandry and Dairying and Ministry of Panchayati Raj; and Members of Parliament Dr K. Laxman and Dr Medha Vishram Kulkarni. This was the first-ever bilateral visit of the vice president of India to Sri Lanka. Earlier, in October 2000, Krishan Kant, the then Vice President of India, had visited Sri Lanka for the state funeral of the former Prime Minister of Sri Lanka, Sirimavo Bandaranaike.