brand logo
Hackers exploit financial defences

Hackers exploit financial defences

24 Apr 2026 | BY Sugeeswara Senadhira


  • Rob $ 2.5 m leaving red faces at CBSL and Finance Min.
  • Indian strategy behind VP’s SL visit
  • Proletariat’s quantum jump to bourgeoisie 


A sophisticated cyber fraud that siphoned nearly US $ 2.5 million from the Central Bank of Sri Lanka (SLBC) with the authority from the Finance Ministry has triggered alarm across Government circles. The cyber hacker attack has exposed a dangerous mix of outdated digital security, weak internal controls, and ignored warnings. 

While early public reports described the incident as a fraud by hackers, investigators now believe the theft may have involved a far more common and effective tactic: business electronic mail compromise (BEC), where criminals infiltrate official email accounts, impersonate legitimate officers, and redirect payments to fraudulent overseas accounts.

The hackers allegedly gained unauthorised access to an email account connected to the Public Debt Management Office / External Resources Department within the Ministry and altered payment instructions tied to international financial transactions, resulting in the unauthorised transfer of funds exceeding $ 2.5 million. 

The money, reportedly moved before detection, raises serious questions over how a Treasury-linked payment could proceed without multi-layer verification. Experts say that hackers look for weak passwords and weak institutions and in this case, Sri Lanka may have offered both.

Perhaps the most troubling aspect of the scandal is the claim the CBSL had issued two prior warnings against the payment, yet the transfer was still processed. If confirmed, this points not only to cyber vulnerability, but also to systemic governance failure. 

While the Ministry and the CBSL conduct internal inquiries, multiple agencies, including the Criminal Investigation Department, have reportedly been asked to investigate. Behind the scenes, officials are said to be urgently reviewing past transactions to determine whether this was a one-off hit or part of a wider undetected scheme.

Cyber security specialists say that these attacks usually follow a predictable pattern. First, the official email account is compromised via phishing or a stolen password. Then, hackers monitor communications silently for weeks to identify legitimate invoice/payment requests and quietly change bank account details. Once the funds were transferred abroad, criminal accounts emptied rapidly. If no secondary phone verification or digital signature exists, millions can disappear in minutes.

For a country rebuilding fiscal credibility after sovereign default, such an incident damages more than finances. It raises concerns among foreign Governments, multilateral institutions, sovereign bond investors, credit rating agencies, and development partners.

Although the theft appears linked to Treasury systems rather than a direct CBSL vault breach, public attention has inevitably shifted toward the broader financial security architecture. Sri Lanka’s banking regulator has previously emphasised growing cyber threats and the need for stronger controls in licensed institutions. 

Financial experts say that any credible response requires an immediate forensic audit by external cyber specialists, freezing and tracing recipient accounts internationally, mandatory dual authorisation for all large transfers, detection systems and immediate Parliamentary disclosure of the findings.

Indian VP’s visit

The recent visit of Indian Vice President (VP) C.P. Radhakrishnan to Sri Lanka was wrapped in diplomatic warmth, development announcements, and cultural symbolism. Publicly, it was about friendship. Quietly, it was about strategy.

In modern diplomacy, senior visits are rarely ceremonial alone. They carry messages, measure political moods, secure influence, and prepare future agreements. This visit was no exception. Behind the speeches and media releases lay four strategic priorities for New Delhi that include the Trincomalee oil tank farm, ports and Tamil politics, and last but not the least, countering China’s strategic inroads.

This first-ever bilateral official visit by an Indian VP to Sri Lanka, signals that New Delhi is giving high priority to the proposed Trincomalee energy hub.

India was always keen to have a deal on the Trinco harbour and oil tank farm. New Delhi made this strategy into a bilateral agreement when it was included in the Indo-Sri Lanka Agreement of 1987 signed by President J.R. Jayewardene and Prime Minister Rajiv Ratna Gandhi. India’s long-term interest is to expand cooperation on the oil tank farm project, build an integrated energy hub, increase industrial and logistics presence and prevent rival powers from gaining strategic leverage in Trincomalee.

That is the reason why Indian Foreign Secretary Vikram Misri emphasised during Radhakrishnan’s visit that Trincomalee must move from promise to implementation. India knows infrastructure delays often become geopolitical openings for others.

India is well aware that whoever has influence over Sri Lankan ports gains relevance in the Indian Ocean. Hence, India’s concerns are to ensure stable access to the Colombo Port that is vital for Indian transshipment trade, deepen involvement in container terminals and logistics, strengthen maritime connectivity between southern India and Sri Lanka, and reduce vulnerability to strategic surprises in nearby ports.

China may not have figured at all during the talks or in any speeches or media releases. But, it was central in the background. China’s footprint in Sri Lanka through the Hambantota Port, infrastructure financing, and construction projects remains a constant concern in New Delhi. India’s strategic doctrine prefers that neighbouring states retain balanced external partnerships rather than drift heavily toward any extra-regional power.

As Misri has clearly outlined, regarding India’s priority of early implementation of the most strategic economic projects in the Indian Ocean, the proposed Trincomalee energy hub and oil storage development, Sri Lanka will have to respond in the near future. Although no brand-new agreement was formally signed during the two-day visit, both Governments used the occasion to accelerate the implementation of previously negotiated understandings involving India, Sri Lanka and the United Arab Emirates. 

This project is to build a hub for strategic fuel reserves, refining and petroleum logistics, bunkering services for global shipping, regional energy trade, and maritime security cooperation. At a time when global fuel markets remain volatile due to Middle East tensions, Sri Lanka’s location has become even more valuable.

If the terms and conditions are professionally negotiated, Sri Lanka could gain many benefits like foreign investment without sovereign debt burden, jobs and industrial development in the East, better fuel security and lower logistics costs, the revival of underused national assets (99 oil tanks), and increased geopolitical relevance. However, Sri Lanka must ensure that national ownership, transparency, and environmental safeguards are protected.

Radhakrishnan’s visit was ceremonial on the surface, but strategic underneath as it demonstrated that India now sees Sri Lanka not merely as a neighbour, but as a crucial partner in energy security and maritime stability. If implemented wisely, Trincomalee could become not just an oil tank farm, but the economic engine of Sri Lanka.

Comrade capital

For decades, Minister K.D. Lal Kantha thundered from dusty stages about the evils of capitalism, the cruelty of private ownership, and the need to liberate the oppressed proletariat from the chains of wealth. He wore simplicity like a revolutionary badge, denounced millionaires as parasites, and promised to build a classless society where all citizens would be equal.

Then, in a miracle unmatched since the parting of the Red Sea, comrade Lal Kantha reportedly became a millionaire according to his latest declaration of assets. Political historians are stunned. Economists are confused. German philosopher Karl Marx himself is said to be rotating so fast in his grave that he could power the national grid, which is badly in need for energy due to gigantic losses on low quality coal purchase.

How did this happen? Sources say that it was not exploitation, corruption, insider deals, or mysterious land appreciation. No, no. It was simply the inheritance and clever investments, no doubt under capitalist economic teachings.

Yesterday, the Minister was condemning private capital. Today, he is apparently managing assets, discussing valuations, and learning the difference between fixed deposits and stock market shares.

Party faithful were initially shaken. But, after an emergency ideological seminar, they were reassured that personal wealth is acceptable if held temporarily, strategically, and preferably in someone else’s name. “He has not betrayed socialism,” Janatha Vimukthi Peramuna/National People’s Power (JVP/NPP) comrades came to his defence. But, they did not say that Lal Kantha has merely infiltrating the bourgeoisie from within.

Meanwhile, ordinary workers who once donated coins to revolutionary causes are asking whether the struggle has ended or merely changed the postal address.

Opposition politicians demanded an inquiry, but many privately admitted admiration. “To move from proletariat to plutocrat in one fiscal quarter,” one rival said, “is efficiency we have never seen in Government.”

The JVP/NPP is about to announce a new economic doctrine: people’s capitalism with revolutionary characteristics. Under the plan, everyone can become rich overnight, provided they first become a Minister. As for the workers of the world, they are still being asked to unite. Preferably outside the gates of the Minister’s new luxury residence.

The views and opinions expressed in this column are those of the author, and do not necessarily reflect those of this publication





More News..