Sri Lanka reports another missing payment days after $2.5M cyber theft

Sri Lanka has disclosed another financial irregularity, reporting on Tuesday that a payment of approximately $625,000 (around 199.7 million Sri Lankan rupees) intended for the United States Postal Service has been missing for several weeks. U.S. officials alerted Sri Lankan authorities after confirming that the payment had not been received, according to local media reports.

Authorities became aware of the issue while investigating a separate attempt by hackers to redirect another payment intended for India. Meanwhile, officials in Australia have reportedly also identified irregularities in payments owed to them, raising concerns that the scope of the financial discrepancies could extend beyond initial findings.

This latest development comes only days after Sri Lankan officials confirmed they were investigating a separate cyber incident involving the theft of $2.5 million. That breach targeted the country’s finance ministry and raised serious concerns about vulnerabilities in government financial systems.

Treasury Secretary Harshana Suriyapperuma told reporters last week that hackers had rerouted funds from the country’s postal authority into unauthorised bank accounts rather than delivering them to the intended recipient.

The nature of the incidents suggests the use of business email compromise (BEC) attacks. In such schemes, cybercriminals infiltrate email systems or financial workflows and manipulate payment details, such as bank account numbers or routing instructions, during invoice processing.

These types of scams remain highly effective. Data from the Federal Bureau of Investigation shows that business email compromise remains one of the most profitable forms of cybercrime, with billions of dollars in losses reported in the past year alone. A single successful breach can result in the theft of substantial sums.

The back-to-back incidents have intensified scrutiny on the Sri Lankan government, which is still navigating the aftermath of a severe economic crisis. The country defaulted on its debt in 2022, triggering widespread protests that ultimately led to the removal of then-president Gotabaya Rajapaksa.

It remains unclear whether the two cyber-related thefts are connected. Nalinda Jayatissa stated that authorities are currently examining whether there is a link between the incidents as part of an ongoing investigation.