Sri Lanka reveals another missing payment, days after hackers stole $2.5 million from its finance ministry

Sri Lanka said on Tuesday that a payment of about $625,000 (about 199.7 million Sri Lankan rupees) to the US Postal Service has been missing for several weeks after US officials reported that the payment had not arrived. local media reports.

Authorities discovered the incident after hackers allegedly tried to divert another payment destined for India.

Australian officials are mentioned is aware of irregularities in payments owed to the country, suggesting that theft in Sri Lanka could be more widespread than first thought.

The revelation comes days after Sri Lankan officials said they were investigating theft of $2.5 million by hackers who had targeted the country’s Ministry of Finance.

Finance Minister Harshana Suriyapperuma told reporters at a press conference last week that hackers diverted the payment from the country’s postal authority “to other bank accounts, instead of the intended recipient.”

These incidents appear to be business email compromise attacks, in which hackers break into inbound email or other accounting systems to manipulate bank accounts and routing numbers during an invoice payment process.

Compromise email scams are popular with cybercriminals, and recent FBI data has shown that such attacks remain one of the top sources of profit for cybercriminals, as hackers can steal huge sums of money through a single breach. The FBI says email compromise attacks resulted in billions of dollars in losses last year alone.

News of successive security breaches has put fresh pressure on the Sri Lankan government after years of economic hardship. The country is still recovering from an economic crisis that saw it default on its debt in 2022 and resulted in months of protests that culminated in expulsion of then President Gotabaya Rajapaksa.

It is currently unclear if the two thefts are connected. MP Nalinda Jayatissa said the government is investigating whether the incidents are linked.