The Criminal Investigation Department Sri Lanka has reported new facts to court regarding the alleged cyber theft of USD 2.5 million from the Sri Lanka Treasury.
Following a review of the investigation’s progress, the Colombo Fort Magistrate’s Court approved a request by the CID to impose overseas travel bans on five officials.
When the case was taken up before Magistrate Isuru Neththikumara, investigators revealed that loan instalment payments made to Export Finance Australia had been diverted to cybercriminals.
According to the CID, financial transactions had been conducted using what appeared to be the official email domain “exportfinance.gov.au.” However, a similar fraudulent domain, “exportfinanceav.com,” had allegedly been created and used for illicit purposes.
Investigators told court that despite a warning issued on October 28, 2025, regarding changes to the domain, the transfer of funds was still carried out. They further stated that no evidence has so far been found of unauthorised access to the official email system.
The CID also informed court that “Enable,” the IT service provider facilitating foreign payment systems for the Ministry of Finance Sri Lanka, had conducted a data examination. During inspections, it was discovered that certain data within the External Resources Department’s system had been deleted, though investigations are ongoing to determine whether this was intentional.
Authorities noted that no suspects have been identified at this stage, and a comprehensive probe is underway under the Public Property Act, the Computer Crimes Act, and the Penal Code.
The CID also sought and received court approval to appoint a special expert committee to carry out a technical investigation. The committee will include representatives from the Government Analyst’s Department, the Sri Lanka Computer Emergency Readiness Team, and the University of Colombo’s Faculty of Computing.
Additionally, the court authorised the inspection of bank accounts belonging to the five officials currently on compulsory leave.
Given the sensitive and technical nature of the case, the Magistrate ordered that the case file be placed in secure custody within the court.
