Sri Lanka strengthens cybersecurity after Finance Ministry fraud

Sri Lanka is strengthening its financial defenses following a US$2.5 million cyber fraud incident at the Finance Ministry. The fraud occurred between December 2025 and January 2026, when criminals used email manipulation to redirect debt repayments intended for Export Finance Australia. The incident caused a breach of a performance criterion under Sri Lanka’s International Monetary Fund (IMF) Extended Fund Facility, though the IMF later provided a waiver.

In response to these vulnerabilities, the Central Bank of Sri Lanka is recruiting a Red Team Specialist on a three-year contract. The role involves simulating sophisticated cyberattacks, hunting for vulnerabilities, and monitoring ransomware, phishing, and dark web activities to proactively identify threats before they can be exploited. This move comes as the nation increasingly digitizes its financial systems and government services.