The numbers keep climbing. A week ago, Sri Lanka's finance ministry said hackers diverted $2.5 million meant for routine government payments. On Tuesday, officials disclosed a second missing transfer worth about $625,000 that was supposed to land at the U.S. Postal Service. Australian authorities are reportedly checking their own books for similar gaps.
This is what a cracked payment system looks like in real time.
The first hack came to light last week, when Treasury Secretary Harshana Suriyapperuma told reporters that hackers had diverted a payment from Sri Lanka's postal authority "to other bank accounts, instead of the intended recipient." Authorities only spotted the second incident after hackers tried to redirect another payment intended for India.
The pattern looks like a business email compromise attack. Hackers break into email inboxes or accounting systems, then quietly swap bank account and routing numbers right before an invoice gets paid. By the time anyone notices, the money is gone.
Recent FBI data shows business email compromise remains one of the most lucrative attacks in cybercrime, with billions of dollars in losses last year alone. A single breach can drain a single company, or in this case, a national finance ministry.
Sri Lanka is still digging out from a debt default in 2022 that triggered months of protests and ended with the ouster of then-president Gotabaya Rajapaksa. Foreign confidence is fragile. International payments are how the government services creditors, contractors, and other governments.
Two missing transfers in a week, with potentially more on the way, raises a different question. If the routing numbers can be swapped, what else got through?
It is unclear whether the two known thefts are linked. Member of Parliament Nalinda Jayatissa said the government is investigating that connection.
The headline number could grow. Australian officials are reportedly aware of irregularities in payments owed to them, which suggests this is not isolated to two transactions. The next data point is whether other counterparties, especially other governments, come forward with missing funds.
