Compromised controls linked to $2.5 m Treasury theft | Print Edition

Sundaytimes.Lk • June 14, 2026

A 100-page report submitted by the Treasury to Parliament on Tuesday on the US$2.5 million Business Email Compromise (BEC) heist has revealed administrative lapses, missing timelines and compromised internal controls, Finance Ministry officials said.

Cyber criminals breached the Treasury External Resources Department’s (ERD) email system and changed beneficiary details, diverting a $2.5 million debt payment, which is part of a larger $ 2.9 million bilateral loan repayment, to an unauthorised bank account.

According to the report, Treasury had received a letter from Australia on November 13, 2025, saying that there is a long overdue debt payment. The invoices of the company were submitted. On the 15th, within the Central Bank (CB) and the Ministry of Finance, officials had questioned among themselves, because the request had come from Australia, going to Dubai and finally ending up in Minneapolis, USA.

A CB accountant, casting doubts on this request, had referred the document to the finance ministry on anti-money laundering suspicions, but had not sent it to the financial investigations Unit at CB. A day later, an accountant at ERD had said that the Australian party is pushing for the payment, saying that the country will be defaulting if the payment is not done.

The payment was done in 5-transfers on November 18, in part on 23rd of that month, spilling into December and mid-January this year.

The heist occurred during a transitional period when debt management duties were being moved from the CB to the newly formed Public Debt Management Office. The report said the Criminal Investigation Department is working with Interpol and other organisations in Australia etc and general financial recovery methods are being followed.

As a precaution against phishing incidents in the future, some emergency control measures were put in place to stop relying on e-mail. Now, financial and Treasury officials are mandated to implement rigorous telephone callback procedures using official and verified communication channels to independently confirm instructions with the original credit.

Hitad.lk has you covered with quality used or brand new cars for sale that are budget friendly yet reliable! Now is the time to sell your old ride for something more attractive to today's modern automotive market demands. Browse through our selection of affordable options now on Hitad.lk before deciding on what will work best for you!

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Treasury Loses $2.5 Million in Business Email Compromise Attack A report from the Treasury revealed that cybercriminals executed a Business Email Compromise (BEC) scheme, diverting $2.5 million in debt payments to an unauthorized account. The attack exploited administrative lapses and compromised internal controls within the Treasury's External Resources Department. The funds were meant for a bilateral loan repayment to Australia but were transferred in multiple transactions between November 18, 2025, and mid-January 2026. The Central Bank of Sri Lanka (CBSL) and the Finance Ministry are currently in a dispute over accountability for the incident. The Criminal Investigation Department is collaborating with Interpol and other organizations for recovery efforts. Emergency measures have been implemented to prevent future phishing incidents, including mandatory telephone callbacks for transaction confirmations. 2 sources 72

Extracted Entities

Compromised controls linked to $2.5 m Treasury theft | Print Edition

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Countries (1)

MITRE ATT&CK (1)