By: Staff Writer
April 28, Colombo (LNW): Sri Lankans are facing growing confusion after contradictory explanations emerged from top government officials regarding the alleged US$2.5 million Treasury fund loss, with shifting narratives raising serious questions about transparency, internal controls, and possible information suppression.
Treasury Secretary Harshana Suriyapperuma confirmed that a cyber intrusion targeting the External Resources Department was detected in January 2026. He stated that hackers manipulated internal email communications and diverted funds to an external account, describing it as a coordinated cyber operation. According to him, the breach was only disclosed later due to security concerns and ongoing investigations.
However, this explanation was quickly complicated by Deputy Minister of Digital Economy Eranga Weeraratne, who rejected the framing of a direct system hack. He stated that the incident appears to be a sophisticated phishing and impersonation scam. Fraudsters allegedly created fake email domains and identities resembling legitimate international officials, deceiving authorities into authorising the payment.
Adding further complexity, Deputy Finance Minister Anil Jayantha Fernando said hackers gained access through compromised email systems, extracted sensitive data, and altered bank account details to redirect funds. He also confirmed that an internal Treasury inquiry involving senior officials had already led to disciplinary actions against some staff.
The fraud was reportedly detected when a similar attempt was made to divert funds intended for India, prompting closer scrutiny of transactions. Authorities have since engaged multiple agencies, including the Sri Lanka Computer Emergency Readiness Team, the Central Bank of Sri Lanka, and the Criminal Investigation Department, while also seeking assistance from Interpol to trace the stolen money through international banking channels.
Despite these efforts, the government’s shifting descriptions—ranging from “system breach” to “phishing impersonation”—have raised public doubts about whether officials are fully aligned on what actually happened. Critics argue that the inconsistency itself reflects deeper governance weaknesses.
Opposition MP Harsha de Silva has gone further, questioning the credibility of the cyber-attack narrative. He said the incident appears more like administrative negligence than an advanced cyber operation. According to him, standard financial safeguards were not followed, including verification of bank details and basic test transactions before releasing large payments.
Dr. de Silva stressed that payment instructions should have been cross-checked against original contracts and that such controls are routine in public finance systems. He warned that the issue cannot be reduced to money simply “going missing,” emphasizing that public funds were lost and responsibility must be clearly established.
He also called for parliamentary scrutiny, noting that oversight of public finances is a constitutional duty. The matter, he said, should be examined by the Committee on Public Finance to determine how such a lapse occurred within the Treasury system.
As investigations continue, the central question remains unresolved: was this a highly coordinated cybercrime, or a preventable breakdown of basic financial controls? The answer may determine not only accountability but also public trust in the government’s handling of sensitive financial systems.
