Sri Lanka’s public financial architecture has suffered a potentially devastating cyber-security failure after hackers diverted US$626,755 intended for the United States Postal Service into nine external bank accounts, exposing weaknesses that extend far beyond one government department.
The Department of Posts did not lose the money through a conventional theft. According to the investigation placed before the Colombo Fort Magistrate’s Court, fraudulent payment instructions were generated through spoofed electronic communications and were acted upon by officials handling international postal settlements.
What makes the case particularly disturbing is its apparent sophistication and patience. Investigators have identified three separate stages over roughly two years. An initial transfer of about US$900 in 2024 appears to have functioned as a test of the system. When that transaction apparently failed to trigger effective detection, the attackers escalated.
In February 2025, more than US$400,000 was diverted. Another transfer of nearly US$190,000 followed in October 2025. Together, the transactions ultimately accounted for US$626,755.
The chronology raises an uncomfortable question: how could a relatively small test transaction be followed by two much larger transfers without the security architecture detecting a developing pattern?
The issue is even more serious because international postal payments operate within established institutional frameworks. The CID informed court that the Universal Postal Union has secure communication and account arrangements for global postal transactions. Yet the fraudulent instructions were apparently transmitted through an email address outside the official UPU channel.
That suggests the central weakness may not have been the international system itself, but the verification procedures used inside Sri Lanka before payment approvals were executed.
The fraud only became publicly known on April 28, 2026, after the USPS alerted Sri Lankan authorities that expected payments had not arrived despite Sri Lanka having processed the relevant settlements.
By then, the money had allegedly been distributed among nine external accounts.
The CID’s Computer Crimes Division subsequently began court-directed investigations, obtaining statements from senior postal officials and securing critical digital evidence. Computers, server records and communication logs connected with the relevant transactions have been taken into custody.
The Sri Lanka Computer Emergency Readiness Team has also been ordered to conduct a forensic examination of the Department of Posts’ digital environment.
The case therefore presents a broader governance test. A government payment system cannot depend solely on employees recognising suspicious emails. Large international transfers require multiple layers of authentication, independent confirmation, transaction monitoring and segregation of duties.
The involvement of the Foreign Ministry indicates another dimension: the money trail extends beyond Sri Lanka and may require international cooperation to identify account holders and recover funds.
Ultimately, the US$626,755 loss is only the visible damage. The deeper concern is whether other government payment systems contain similar vulnerabilities and whether those weaknesses are being discovered by investigators after money disappears rather than by security controls before it does.