• The forms were reviewed by 14 officials before payment was made
• Treasury Secretary remains silent for months in an attempt to cover up the theft
• Nothing can be done without the Treasury Secretary‘s signature
• The Treasury’s computer system was hacked in Sept. 2025 and the authorities carried on as if nothing had happened
• No information about an investigation, no info about which court this matter was reported to, no info about the case number and no info about the B-report

A cyber fraud involving nearly US $ 2.5 million diverted from a Government payment linked to a bilateral transaction with Australia has come under intense public scrutiny, with many asking how such a large sum could be redirected from an official Treasury-linked payment. The incident, which occurred early this year, involved funds meant to be transferred to an Australian creditor, but the money was diverted after electronic mail communications connected to the payment were interfered with by cyber actors. Although the payment was processed through official systems, the intended recipient did not receive the funds.

Finance, Planning and Economic Development Ministry Secretary and Treasury Secretary Dr. Harshana Suriyapperuma told the media last week the issue was detected in January 2026 after attempts were made by cyber actors to access the email system of the Ministry’s External Resources Department (ERD). He said that law enforcement agencies, including the Computer Emergency Readiness Team (CERT) and the Police Computer Crime Investigation Division (CCID), were informed soon after, and that investigations are continuing to trace the diverted funds.

The 'Free Lawyers' organisation was the first to formally lodge a complaint with the Speaker of Parliament, Dr. Jagath Wickramaratne, noting that Parliament holds responsibility for public finances, and called for the matter to be taken up at Parliamentary level.

In an interview with The Daily Morning, the Organisation's President, President's Counsel (PC) Maithri Gunaratne, spoke on the developments surrounding the incident, his views on the responsibility of key institutions, the progress of the investigations, and the wider implications of the fraud for public finance and national security.

Following are excerpts of the interview:

Could you give a brief description of the ‘Free Lawyers’ organisation?

This organisation is not a political movement. It consists of a group of people who love this country and believe that Sri Lanka needs a certain level of systemic change, or good governance. Politically, there are individuals who are affiliated with different political parties, and there are also people who are not involved in politics at all. What all of us share is a common expectation to make Sri Lanka a better country than it was at the time we were born.

What background led your group to submit a complaint to the Speaker regarding this incident?

We were the ones who first informed the Speaker about this matter. These details had already reached Opposition Parliamentarians, but they did not make any disclosure about it. These are very serious issues. For ordinary citizens to reveal matters like this is equal to risking one’s life. Even so, if Opposition MPs follow a silent approach on incidents of this nature, then, responsible citizens like us are left with no choice but to expose them. If public funds are being looted in broad daylight, we cannot remain silent. President and Finance, Planning and Economic Development Minister Anura Kumara Dissanayake said that his Government would protect public money like sacred property. When that same money is looted, how can we wait doing nothing? That is why we submitted a complaint to the Speaker.

How did your organisation first become aware of this incident?

If you look at the Finance Ministry, the person appointed as the Secretary (Dr. Suriyapperuma) is someone who was brought from Australia, sent to Parliament through the National List, and then appointed as the Deputy Finance Minister. He is an unsuccessful businessman who has no knowledge. When people inside the Ministry see the kind of shortsighted actions being carried out there, those who truly care about the country and the people feel distressed. Those individuals were the ones who provided us with this information. After receiving the details, we verified them and then submitted a complaint to the Speaker.

Dr. Suriyapperuma said that they were aware of the incident but did not make it public because action was needed to bring the offenders before the law. What is your response to that explanation?

That is not an answer that should come from someone holding an important and senior position like the Treasury Secretary. He is responsible for managing public funds. Accountability for public funds lies with Parliament. If an incident of this nature took place, Parliament should have been informed first. If what he claims is true and this was a hacking, that can happen to anyone. Banks get hacked; our email accounts get hacked; our social media accounts get hacked. What will happen then? We act immediately. For example, if a bank account or credit card is hacked, we report it to the Police right away, inform the bank, deactivate the account or card, and take every possible action without delay. If an ordinary citizen takes such immediate steps, why did the said Secretary remain silent for months? After we exposed this incident, he came before the media and said that he had taken various actions. I don't think that anyone will accept that excuse. What he tried to do was suppress the incident somehow and allow it to be forgotten without anyone knowing. At the same time, up to now, the Presidential Secretariat has not uttered a single word about this. When Cabinet of Ministers Spokesperson Dr. Nalinda Jayatissa was questioned at a media briefing, he said that he knew nothing about it. That means the Treasury Secretary acted above the President and the Cabinet. He attempted to completely cover up this theft.

Based on the information reported to your organisation, what is believed to be the origin of this incident?

We have learned the Treasury’s computer system was hacked in September of last year (2025). If such an incident occurred, they should have acted with extreme caution. Instead, they appear to have ignored the seriousness of the matter and carried on as if nothing had happened. The hacker is believed to have sold a large volume of information to another party. The party that purchased that information then used it and made a certain request through an email. It was based on that request that the $ 2.5 million was paid. After receiving that request, Treasury officials obtained approval from the Central Bank of Sri Lanka (CBSL) and completed all necessary application forms. Those forms were reviewed by 14 officials before the payment was made. Nothing can be done without the signature of the Treasury Secretary. He must take full responsibility. He is directly or indirectly connected to this incident. He is a very close associate of the President. Both the President and the Deputy Finance Minister are protecting him.

Is the reported figure of $ 2.5 million that was lost from the Treasury numerically accurate?

The $ 2.5 million figure linked to this transaction is 100 per cent correct. The CBSL and the Treasury Secretary have accepted that figure. The amount is also mentioned in documents held by the committee that is currently investigating this matter. There is no doubt about that. The real concern now is whether payments related to other transactions were also made incorrectly in a similar way. To properly determine that, a forensic audit must be carried out. The President has been appointing commissions to investigate corruption that is said to have taken place over 30 or 40 years. In the same way, a commission should now be appointed to investigate this massive robbery.

Do you see this as purely a cyber security issue, negligence, or an act of fraud or corruption?

All of those aspects are connected to this incident. Positions such as the Treasury Secretary and the CBSL are usually given to individuals who possess the knowledge and expertise. For example, when the CBSL Governor was nearing retirement, the Government granted him a service extension. They did not remove him and appoint some henchman in his place. Even though they had said during their campaign they would remove him immediately after coming to power, they did not do so. They knew that removing him would cause the economy to collapse. But, at the same time, they brought in an unsuccessful businessman who had spent about 15 to 20 years in Australia and appointed him as the Treasury Secretary. He has no knowledge or experience.

What is your view on the suspension of officials that was reportedly carried out following preliminary investigations?

This Government has a pattern. Whenever a Minister or a Ministry Secretary needs to be removed, they place the blame on some official and remove that person instead. In reality, the President should resign as the Finance Minister. He is the one who appointed this Treasury Secretary who lacks knowledge and experience. At the same time, the Secretary should be removed from his position. After that, an independent team must immediately conduct an investigation to find out where this large sum of money has gone.

Have you received any response to the complaint submitted to the Speaker?

This Speaker himself is a person facing allegations. The Government stated that professionals and educated individuals would be appointed to top positions, but, in reality, they are all rogues. It is very clear to us that the Speaker will never deliver justice on this matter. At this point, we must be grateful to the media and social media platforms. They acted swiftly and ensured that information about this incident was reported. If that had not happened, this matter could have been completely suppressed, and the public could have suffered a serious injustice.

Can the country be considered satisfactory in terms of cyber and other forms of security?

There is a serious problem in this country when it comes to security. The person holding the position of the Defence Secretary is not carrying out his responsibilities. With individuals like that in place, it is impossible to guarantee security in any sector of the country. The other point is that the group now in power was once responsible for terrorist activities that led to the killing of thousands of people. Because of that, we can be about 50 per cent less fearful.

Is it possible to seek any form of foreign intervention in relation to this incident?

We should feel ashamed to ask for international intervention, shouldn't we? If we can’t protect the money held in our own Treasury, how can another country or an institution from another country protect it? The three key Ministries — Defence, Digital Economy, and Finance — are all held by the President. He has taken on everything at once. Shani Abeysekara, who is a National People's Power henchman, has been appointed to the Criminal Investigation Department. He conducts investigations in whatever manner he chooses. Now we ask Abeysekara: where are the investigations carried out in relation to this incident? Where are the cases that have been filed?

Does Sri Lanka possess the expertise required to investigate fraud of this nature?

These incidents can be investigated. Our country has capable and experienced officers. However, one of the biggest problems in this country is that the right person is rarely given the right position. For example, consider the appointment of Arjuna Mahendran as the CBSL Governor in 2015. The group currently in power accused the then Prime Minister Ranil Wickremesinghe of appointing a friend to that position. But, did the President and Government not do exactly the same thing? Was not the Treasury Secretary appointed to that position because he is a friend of the President?

Do you have any views on the parties that may have orchestrated or assisted in carrying out this fraud?

Based on what we have learned, this act appears to have been carried out by a foreign group. It is also possible that there was assistance from certain local parties. This transaction is linked to Australia. The Treasury Secretary lived in Australia for many years and was involved in unsuccessful business ventures. Even after becoming aware of this matter in January, he didn't take proper action.  When all these factors are taken together, many suspicious elements emerge. To obtain accurate information about these matters, a proper investigation must be conducted. If these issues are kept hidden, how will the public ever come to know the truth? Let us imagine that an ordinary person faced allegations of this nature. What would the Police do? They would arrive, take that person into custody, and even produce a false report if necessary, claiming that he committed the offence. But the Treasury Secretary is someone appointed by the President, so he receives every form of protection under this Government.

What impact could incidents like this have on the investment sector and the country’s foreign exchange reserves?

Foreign investors will look at this situation and ask themselves how a country that can’t protect the money held in its own Treasury can guarantee the safety of foreign investments. This could have a highly negative impact on foreign investment. At present, our country’s foreign exchange reserves are close to only $ seven billion. If $ 2.5 million can be stolen in this manner, what guarantee is there that similar incidents will not affect the remaining foreign reserves? 

Could this fraud have been prevented through proper verification and authentication processes?

I am a lawyer. Let me give a simple example. When an ordinary citizen goes to court and deposits bail money, how many application forms must that person complete to take that money back later? In some cases, even the birth certificates of parents are required to be submitted. If the procedures for such matters are that strict, imagine how strong the procedures should be in an institution like the Finance Ministry and the Treasury. The officers working there are considered top-tier officials. They receive salaries several times higher than that of other public servants. When unsuccessful businessmen such as the Treasury Secretary are brought into such institutions, incidents like this are bound to occur.

Does the CBSL bear any responsibility in relation to this incident?

The CBSL must also bear responsibility. At first, we believed that the CBSL was not connected to this matter. That was because, in 2024, legislation was introduced to separate the responsibilities of the Treasury and the CBSL. However, this incident took place during the transitional period when the provisions of that legislation were being implemented.

What is your view on the investigations that are said to be currently underway?

We have not received any information indicating that any investigation is actually taking place. Even now, the Treasury Secretary has not been able to state which court this matter was reported to, under what case number, or under which B-report. That suggests that his intention was to completely suppress this incident.

Has there ever been a previous instance where funds belonging to the Treasury were fraudulently obtained by an external party in this manner?

I can’t recall any such theft or misconduct of this nature in recorded history. Even if we consider the CBSL Treasury Bond scams that took place during the United National Front Government period, it is not comparable to this incident. At that time, the CBSL Governor provided certain internal information to one of his family members. Such practices occur even in stock markets. 

Under which legal provisions can action be taken in relation to this incident?

This matter can be addressed under criminal law. It can also fall under legal provisions related to money laundering. In my view, all aspects including fraud and criminal misappropriation should be examined. To determine which specific laws apply, a proper investigation should first be carried out and sufficient information gathered.

The views and opinions expressed in this column are those of the interviewee, and do not necessarily reflect those of this publication