Sri Lankan lawmakers clashed over accountability following a cyber fraud that diverted $2.5 million in sovereign debt payments, with government and opposition offering competing explanations for institutional failures during a debt management transition.
Parliament held a heated debate on Wednesday over a $2.5 million fraud involving sovereign debt service payments, following the release of a Committee on Public Finance (COPF) report. Both government and opposition members confirmed in the bipartisan report that a major breach occurred in sovereign debt operations, but disagreed sharply on whether the incident was primarily a cybersecurity attack or a deeper governance failure.
The fraud unfolded during a transitional period when debt management functions shifted to the newly established Public Debt Management Office (PDMO) beginning January 1, 2026. Between mid-November 2025 and late November 2025, cybercriminals impersonated officials and sent fraudulent invoices directing repayments meant for Australian and Export Finance Australia loans to accounts in Abu Dhabi and Minneapolis instead. The government claimed it acted immediately upon detecting the breach, while the opposition highlighted that basic verification protocols were absent and that the Treasury's Microsoft Exchange Server had lost its security certification in October 2025, leaving systems vulnerable.
Government officials attributed the incident to weak internal controls inherited from previous administrations and maintained their response was swift. However, opposition leaders including Sajith Premadasa argued the incident reflects broader structural and governance failures, noting the absence of standard operating procedures and memoranda of understanding between the Central Bank and Treasury during the transition. Opposition MP Ravi Karunanayake criticized both institutions for insufficient due diligence, noting that the US Federal Reserve had flagged suspicious activity as early as November 24 but payments proceeded regardless.
The report also addressed a controversial suspension of four junior officers and the subsequent death of one official. The COPF concluded that senior officials at the level of the Treasury Secretary and Central Bank Governor bear responsibility for the lapses. Regarding recovery, Public Security Minister Ananda Wijepala stated that American financial intelligence had traced the stolen funds across secondary accounts in multiple countries, but complete retrieval is unlikely. If international recovery efforts fail, Sri Lankan taxpayers may absorb the loss through state funds used to repay the debt settlement owed to Australia.
