Subscribe to our WhatsApp Channel
The alleged cyberattack involving unauthorized access to the computer system of the Ministry of Finance’s Department of Foreign Resources and the reported misappropriation of USD 2.5 million has emerged as a prominent national concern in recent days. Alongside this, a significant volume of related content, much of it unverified and potentially misleading, has been circulating across social media platforms. This article presents a fact-checking analysis of one such widely shared claim.
Social Media Posts:
Claim 1:
The post, dated 22 April and purporting to originate from the official Facebook page of Newsfirst, alleges that the President made a statement claiming, “We have the cheque numbers from which the Australian hacker who stole USD 2.5 million from us provided USD 2 million to Mahinda Rajapaksa.”
Fact Check
Media reports here and here covering a statement issued on 22 April by the Free Lawyers organization drew significant national attention, highlighting concerns that the Sri Lankan government may have identified that a portion of the USD 2.5 million payment, from a total of USD 22.9 million due by the end of September 2025, had been misdirected to a third party, namely a computer hacker, rather than to the intended creditor country.
Neither News First nor any other media outlet has reported such a story.
We examined whether the post containing the statement purportedly made by the President had been published on the official Facebook page of Newsfirst, and found no reference to any such statement. Furthermore, several discrepancies were identified between the date and location details in the posts circulating on social media and those published on the official Facebook page, as outlined below.
Meanwhile, the Assistant Manager of the Digital Division of Newsfirst also confirmed that the statement circulating on social media was not published on the organization’s official page. Furthermore, no reports were identified in any other mainstream media outlets indicating that the President had made such a statement.
Presidential Media Division
The Presidential Media Division also clarified that the President had not made any statement currently circulating on social media, further confirming that the content in question is a fabricated post.
Claim 2:
Several statements purportedly made by Deputy Minister Chathuranga Abeysinghe are currently circulating on social media in relation to the incident in which a USD 2.5 million loan instalment owed by the Sri Lankan government to the Australian government was allegedly transferred to a hacker’s account.
Among these, the following post alleges that Deputy Minister Chathuranga Abeysinghe stated that the government has strengthened its cybersecurity systems and was able to swiftly identify how even such a small amount of money came into the possession of hackers. The post has been presented in a manner that gives the impression it was published on the official Facebook page of Independent News.
Another post circulating on Facebook alleges that Deputy Minister Chathuranga Abeysinghe stated that Chinese hackers, purportedly supported by the Rajapaksa family, had accessed and taken funds from the state treasury.
Fact Check
Accordingly, we verified whether a post had been published on the official Facebook page of the Independent Television Network, alleging that the Deputy Minister had stated the government had strengthened its cybersecurity systems to the extent that even a small amount of money could be swiftly misappropriated. However, no such post was found on the official page. However, a post posted on the official account stated that the above post circulating on social media was a fake post | Archived Link. It further stated that it was a fake news story fabricated using the Independent Television News brand.
Concurrently, our investigation found that no reports have been published in any mainstream media outlets regarding the alleged statement attributed to the Deputy Minister, claiming that Chinese hackers supported by the Rajapaksa family had misappropriated funds from the state treasury.
Social media posts are false – Deputy Minister
Simultaneously, Deputy Minister Chathuranga Abeysinghe, in a post on his official Facebook page, has stated that the content circulating on social media attributed to him is entirely false. He further clarified that the information and claims contained in those posts are not in any way accurate and do not originate from any official source.
At the same time, the Deputy Minister’s media secretary has also confirmed that the Deputy Minister has never made any statements of nature presented in the posts currently circulating on social media.
Claim 3:
Another post, accompanied by a photograph of the Minister Bimal Rathnayake claims that according to information received, there are indications of the Rajapaksa family’s involvement in the Treasury hacking incident, and that Rohitha Rajapaksa is expected to be summoned to the Criminal Investigation Department in the near future to provide a statement in this regard.
Fact Check
Both government and opposition MPs are expressing different opinions regarding the controversial incident of US$2.5 million in loan installments owed to the Australian government being transferred to a hacker’s account. If Minister Bimal Ratnayake had made any statement about the incident circulating on social media, such a statement would also have been reported through mainstream media channels. However, no media outlet has reported that the Minister made any such statement in connection with the incident.
Accordingly, we inquired with the Minister’s Media Secretary as to whether the Minister had made the said statement or any similar remarks. He confirmed that the Minister had not made any such statement circulating on social media, and further stated that the post in question is false.
The incident where $2.5 million was allegedly transferred to a hacker’s account
The announcement by the Free Lawyers organization alleging that a computer hacker had misappropriated USD 2.5 million in foreign loan instalments from the Treasury has attracted nationwide attention. In this context, journalists raised questions regarding the matter with the Cabinet Spokesperson during the press conference held on the 22nd to announce Cabinet decisions.
At that time, Cabinet Spokesperson Minister Nalinda Jayatissa stated that the Speaker would review the relevant matters and determine whether an investigation should be initiated. The Cabinet Spokesperson further noted that, at that stage, he was in possession of only the relevant letter and did not have any additional details regarding the matter.
Announcement from the Ministry of Finance
On the 22nd, the Ministry of Finance, Planning and Economic Development issued a statement confirming that it had lodged complaints with law enforcement authorities and other relevant institutions in relation to an alleged cyber intrusion and theft involving hackers who gained access to the computer system of its Department of Foreign Resources.
It further stated that a preliminary internal investigation into the incident had been conducted, that the necessary measures had been implemented, and that disciplinary action had been taken against several officers involved.
The declaration moreover indicated that, as investigations are currently ongoing, updated information will be disclosed at an appropriate time so as not to impede the progress of those proceedings.
Explanation by the Deputy Minister of Finance and Planning
Deputy Minister Dr. Anil Jayantha Fernando, on 22 April, provided clarification regarding the alleged crediting of a loan owed by the Treasury to an Australian export finance company to an account associated with a hacker. He stated that the email communication system used to exchange information related to financial settlement activities between the Australian Export Finance Company and the Treasury had been compromised, resulting in the interception and alteration of the relevant information. Meanwhile, the Deputy Finance Minister additionally stated that cybercriminals had attempted, through this method, to unlawfully obtain funds that were intended to be remitted to India.
“In addition to this payment, which was processed due to our lack of awareness, hackers have made another attempt to obtain funds in a similar manner, relating to an amount payable to India. Accordingly, when suspicions arose—particularly in relation to changes in account numbers—the Treasury promptly informed the Computer Crime Investigation Division of the Sri Lanka Police and the Sri Lanka Computer Emergency Readiness Team at the earliest point at which the alterations to the account details came to light.”
“They conducted a detailed and extensive investigation. This involved a series of exchanges as they initiated the communication process for restructuring the debt and arranging repayments, while simultaneously continuing their inquiries. As a result, it was determined that the funds owed to the Australian Export Finance Corporation had been diverted into accounts controlled by the hackers. Accordingly, an immediate complaint was again lodged with the Criminal Investigation Department, and a formal complaint is currently being pursued in relation to the matter.”
Simultaneously, Secretary to the Ministry of Finance Dr. Harshana Suriyapperuma, speaking at a special media briefing, stated that all necessary measures have been taken, with the assistance of both local and international experts, to apprehend the perpetrators and recover the misappropriated funds in relation to a cyberattack targeting the computer system of the Department of Foreign Resources of the Ministry of Finance.
The Secretary also specified that an official committee, comprising two Deputy Secretaries of the Treasury, has been appointed to conduct an internal investigation into the incident, and that disciplinary action has been initiated against the individuals identified, in accordance with the law.
The Secretary to the Ministry of Finance further affirmed that preliminary investigations have indicated that, through this transaction, a third party has received nearly USD 2.5 million in payments owed by the Sri Lankan government to an Australian institution.
Announcement from the Australian High Commission
The Australian High Commission in Sri Lanka, in a statement posted on its X account, has indicated that both the Sri Lankan Ministry of Finance and the Australian High Commission are aware of irregularities identified in payments made to the Australian government. The Australian High Commission stated in a post on its X (formerly Twitter) account that Sri Lankan authorities are currently investigating the matter and are cooperating with Australian officials to support the ongoing inquiry. It further noted that Australia remains committed to supporting Sri Lanka’s return to debt sustainability.
Concurrently, concerns have been raised by various parties, including the opposition, questioning the government’s ability to safeguard the country’s financial security and the reasons for any alleged lack of transparency surrounding the matter. The Opposition Leader has further questioned whether those responsible should resign and whether the citizens of the country should be required to bear the cost of compensation for the alleged financial losses.
We invite you to join us to gain insight into our fact-checking efforts.
Facebook | Twitter | Instagram | Google News | TikTok
Conclusion:
Our investigation indicates that the President, Minister Bimal Ratnayake, and Deputy Minister Chathuranga Abeysinghe have not made any of the statements currently circulating on social media regarding the alleged cyberattack, in which approximately USD 2.5 million was reportedly stolen from the computer system of the Department of Foreign Resources of the Ministry of Finance. It has also been found that some of these posts are fabricated, created by misusing official logos and replicating Facebook post templates of recognised media organisations.
However, it has been confirmed that the Treasury transferred a loan payable to an Australian export finance company into a hacker’s account, and the government has stated that the relevant law enforcement authorities have been informed and that investigations are ongoing.
Title: False social media posts claim the President and other ministers stole $2.5 million!
Fact Check By: Sagarika Chathumali
Result: False
