A cyber attack has compromised Sri Lanka’s finance ministry computer network, resulting in the theft of $2.5 million. The government announced this on Thursday, marking the largest amount ever stolen from a government agency in the country, which is heavily burdened by debt.
This breach is a severe setback for Sri Lanka, which has been struggling to recover from a severe economic crisis in 2022 after defaulting on $46 billion in external debt.
The funds taken were meant for debt repayment to Australia, according to Harshana Suriyapperuma, the secretary of the finance ministry, who spoke to reporters in the capital.
Following the breach, four senior officials at the Public Debt Management Office (PDMO) were suspended.
Authorities detected an unauthorized attempt to access the ministry’s email server, and subsequent investigation revealed that a payment of $2.5 million owed to Australia had gone missing.
“Investigators are examining the situation, and we can’t share further details at this moment,” Suriyapperuma stated. He also mentioned that Sri Lankan officials are seeking assistance from international law enforcement agencies.
The PDMO was established earlier this year as part of Sri Lanka’s response to its economic turmoil, aided by an IMF-approved bailout package totaling $2.9 billion issued in early 2023.
Matthew Duckworth, Australia’s High Commissioner to Sri Lanka, confirmed that Canberra was aware of “irregularities” concerning payments it was owed.
“Authorities in Sri Lanka are investigating and coordinating with Australian officials, who are assisting with the inquiry,” Duckworth added on social media platform X.
He reaffirmed Australia’s commitment, emphasizing ongoing support for Sri Lanka’s efforts to restore debt sustainability.
Earlier this year, Sri Lanka’s central bank and finance ministry launched a campaign in local newspapers warning residents about cyber scams, likely in response to the increasing digital threats facing the country.
Workers are seen near a Qantas Airways Boeing 737-800 plane parked at Adelaide Airport, Australia, August 22, 2018. — Reuters
– Major cyberattack impacts global companies through Salesforce.
– Sensitive customer information has been exposed, though no financial data was compromised.
– Major tech and airline corporations targeted in the breach.
A large-scale cyberattack has resulted in the theft of data from 5.7 million Qantas customers, which was subsequently leaked online as part of a broader security breach affecting numerous firms.
Allegedly, prominent companies including Disney, Google, IKEA, Toyota, McDonald’s, and airlines such as Air France and KLM experienced data theft in an attack targeting Salesforce, a major software provider. The stolen information has been held hostage in ransom demands.
Salesforce disclosed earlier this month that it was aware of recent extortion attempts by cybercriminals.
Qantas announced in July that hackers infiltrated a third-party customer contact center, gaining access to a systems used by Salesforce. The breach exposed customer names, email addresses, phone numbers, and birthdays.
Since then, no additional breaches have been reported, and the airline is working with Australian security agencies. The company stated that much of the leaked data comprised names, email addresses, and frequent flyer numbers. However, some information also included addresses, dates of birth, genders, meal preferences, and phone numbers.
Qantas emphasized that credit card details, financial information, and passport data remained unaffected. The airline also secured a legal injunction from the Supreme Court of New South Wales to prevent the leaked data from being accessed or published.
Cybersecurity expert Troy Hunt commented to AFP that such legal measures are unlikely to prevent the data’s further dissemination, calling the situation “ridiculous” and noting that security efforts do little to stop criminals outside of Australia.
Google pointed AFP to a statement from August, confirming that one of its Salesforce servers was targeted, but did not confirm whether data was leaked. Melanie Lombardi, head of Google Cloud Security Communications, added that Google responded to the incident, assessed the impact, and notified potentially affected businesses.
Analysts have linked the breach to hackers associated with the Scattered Lapsus$ Hunters, a cybercriminal alliance. According to research from Unit 42, the group claimed responsibility for attacking Salesforce tenants as part of a coordinated effort to steal and ransom data, with a deadline set for ransom payment on October 10.
The hackers employed social engineering tactics, manipulating victims by impersonating company representatives to gain access—an approach last month warned against by the FBI. Experts say the attack was carried out using “the oldest tricks in the book” rather than sophisticated technical exploits.
This incident, involving Australia’s largest airline, underscores increasing concerns about data security amid a string of high-profile cyberattacks in the country. Last year, Qantas apologized after a mobile app glitch exposed some passenger details, and in 2023, hacking of port systems handling nearly half of Australia’s freight trade brought operations to a halt.
Several major European airports, including London’s Heathrow—Europe’s busiest—scrambled on Sunday to resume normal operations following a cyberattack that disrupted automated check-in systems. The breach targeted Collins Aerospace, a check-in and boarding system provider owned by RTX, leading to chaos at Heathrow, Berlin Brandenburg Airport, and Brussels Airport, where travelers experienced long lines, flight cancellations, and delays.
By early Sunday morning, disruptions had decreased significantly, with airport officials and data indicating that delays were still occurring but fewer in number. Authorities confirmed they are investigating the cyberattack’s origin. Brussels Airport canceled 45 of its 257 scheduled departures for the day but managed to keep delays manageable through operational adjustments. A spokesperson mentioned delays ranged from 30 to 90 minutes and that the duration of disruptions remains uncertain.
One Brussels passenger reported minimal disruption, describing their experience as “business as usual,” though acknowledging some travelers without online check-in or checked baggage might face longer waits.
This incident marks the latest in a string of cyberattacks impacting sectors such as healthcare and automotive manufacturing. For example, Jaguar Land Rover had to halt production due to a breach, and Marks & Spencer suffered hundreds of millions of pounds in losses. RTX labeled the event a “cyber-related disruption,” noting that it affected its MUSE software, which services multiple airlines. The company did not respond immediately to inquiries on Sunday.
Berlin Brandenburg Airport has confirmed ongoing issues but assured the public that it is working with RTX to resolve the matter. A manual workaround is in place, and there are currently no significant delays or cancellations. Heathrow also reported ongoing efforts early Sunday to recover from the check-in system outage, emphasizing that the majority of flights continued to operate smoothly.
An aviation data analysis by Cirium indicated that Heathrow’s delays are minimal, Berlin is experiencing moderate delays, and Brussels has seen significant delays that are gradually decreasing.
A cyberattack targeting a provider of check-in and boarding system services caused significant disruptions at several major European airports, including London’s Heathrow, Brussels, and Berlin, resulting in delays and cancellations on Saturday. Collins Aerospace, which supplies check-in and boarding technology to numerous airlines worldwide, is experiencing a technical glitch that may lead to delays for travelers departing from affected airports, according to London Heathrow. The parent company, RTX, did not respond immediately outside U.S. business hours.
The attack has disabled automated systems, forcing airports to rely on manual check-in and boarding procedures. Brussels Airport issued a statement on its website indicating the situation has considerably impacted flight schedules, leading to delays and cancellations. The airport is actively working to resolve the issue as quickly as possible.
Travelers scheduled to fly on Saturday were advised by the affected airports to verify their flight status with airlines before arriving at the airport. Berlin Airport also issued a notice on its website, stating, “Due to a technical problem with a system provider operating across Europe, check-in times are longer than usual. We are working on a quick solution.” However, Frankfurt, Germany’s largest airport, confirmed it was not affected, nor was Zurich Airport’s operations impacted.
The disruption has led most other airports to issue advisories urging passengers to check their flight statuses prior to travel, emphasizing ongoing efforts to restore normal operations amid the cyberattack.
Sure! Here’s a rewritten version of the content in American English, maintaining its essence while making it unique and plagiarism-free:
—
A contactless payment card reader at an M&S Food Hall in London, UK on April 30, 2025. Reuters
LONDON: Several major retailers in the UK have faced significant setbacks due to recent cyberattacks, with Marks & Spencer (M&S) suffering a loss of £700 million in market value within a week and still unable to fulfill online orders.
Entering their second week of disrupted online orders, M&S experienced a major cyber incident last week, while the Co-op Group disclosed that hackers had compromised customer data.
Since the hacking incident was disclosed, M&S has seen a £700 million ($930 million) drop in its stock market valuation. The recent troubles faced by the Co-op and Harrods, a London department store, prompted the UK’s National Cyber Security Centre (NCSC) to label these incidents a “wake-up call.”
In recent years, British companies, public institutions, and organizations have been under a barrage of cyberattacks that have cost them millions and often led to months of operational disruptions.
M&S, a well-established name in British retail for 141 years, halted clothing and home goods orders via its website and app starting April 25, following issues with contactless payment and click-and-collect services over the Easter bank holiday weekend.
The Co-op initially announced a cyberattack on Wednesday but revealed on Friday that sensitive information related to many current and former members—such as names, contact information, and dates of birth—had been compromised.
Ciaran Martin, the former CEO of the NCSC, told Reuters that currently, there’s no indication that the attacks on M&S, the Co-op, and Harrods are interconnected, suggesting that the latter two incidents might have been uncovered due to increased alertness following M&S’s breach.
“If this can happen to M&S, it could happen to anyone,” he remarked, emphasizing that recovery from such a significant attack often takes a considerable amount of time.
On Friday, M&S CEO Stuart Machin issued another apology to customers but did not provide a timeline for restoring online ordering.
“We are working tirelessly to manage the current cyber incident and aim to return to normal operations for you as swiftly as possible,” he communicated in an email to M&S customers.
With M&S operating approximately 1,000 stores in the UK and generating about one-third of its clothing and home sales online, analysts predict a temporary decline in profits is unavoidable.
While M&S has refrained from disclosing the financial impact, it continues to grow as they miss sales opportunities for new seasonal collections amid a record-breaking hot May in the UK.
Last year, commuters faced nearly three months of account lockouts following a cyberattack on London’s transport authority, TfL. Another assault on a blood testing processing company in London also disrupted services for over three months.
Some food items have been affected in specific M&S locations, and broader disruptions appear to be impacting the company, which has removed job postings from its website.
M&S shares closed down by 1%, bringing their losses since Easter to about 9%.
‘Increasingly Sophisticated’ Attacks
Helen Dickinson, CEO of the British Retail Consortium, noted that cyberattacks are becoming “more advanced,” compelling retailers to invest hundreds of millions annually in cybersecurity measures.
“All retailers are constantly updating their systems to ensure maximum security,” she added.
According to technology site BleepingComputer, a ransomware attack believed to have been executed by a hacking group called “Scattered Spider” targeted M&S’s servers.
The NCSC is collaborating with the affected retailers, while the Metropolitan Police’s Cyber Crime Unit and the National Crime Agency (NCA) are probing the M&S incident.
“These incidents should serve as a wake-up call for all organizations,” stated NCSC head Richard Horne.
Labour MP Matt Western, who chairs Parliament’s Joint Committee on the National Security Strategy, expressed that the government needs to take stronger measures to prevent large-scale cyberattacks.
“As the government wraps up its consultation on strategies to combat ransomware, I hope its response addresses these threats with the seriousness they warrant.”
The hacking collective Anonymous has asserted its role in a major cyberattack targeting Russian networks, claiming to have released 10 terabytes of leaked information that they say includes sensitive data about political figures, state-linked businesses, Kremlin assets abroad, and even documents that allegedly connect to former President Donald Trump.
The group made the data public on April 15 and announced it through their official X account, previously known as Twitter. In the announcement, Anonymous stated: “In defense of Ukraine, Anonymous has released 10TB of leaked data regarding all businesses operating in Russia, Kremlin assets in the West, pro-Russian officials, Donald Trump, and more.”
The post featured an image showcasing file folders, one of which was labeled “Leaked Data of Donald Trump.”
Although specifics about the contents were not disclosed, the inclusion of Trump has sparked widespread attention, especially amidst ongoing scrutiny of his foreign policy actions.
Photo: X
Anonymous, which operates without a centralized leadership, has a well-documented history of “hacktivism”—using cyberattacks to expose or disrupt entities seen as corrupt, oppressive, or dangerous.
The group first declared war on Russian cyber operations in 2022, soon after Moscow initiated its full-scale invasion of Ukraine.
This recent operation is among the largest that Anonymous has claimed in recent years. Cybersecurity experts indicate that while the full ramifications of the leaked data are yet to be determined, the sheer size—10 terabytes—suggests a significant breach that could impact diplomatic and economic relations connected to Russia.
Reports indicate that the data may reveal connections between Russian businesses and foreign operations, uncovering financial transactions and the identities of pro-Kremlin officials tied to assets in Western nations.
While there has been no formal response from the Russian government, analysts believe that internal assessments are likely underway to gauge the extent of the breach.
The timing of the leak coincides with a renewed global focus on Trump’s foreign activities. Recently, Anonymous has amplified its criticism of the Trump administration, alleging that the former president is acting against the interests of Ukraine and undermining international democratic principles.
In a recent message, the group remarked: “Trump is working against Ukraine. He stands with Russia. Don’t believe for a second that his aim is to assist Europe, the Ukrainian people, or American security. His purpose is to weaken and ultimately dismantle global democracy, international law, and you.”
At this time, Anonymous has not issued any further threats or additional leaks.
The collective continues to remain engaged on social media, regularly posting commentary about the ongoing war in Ukraine and geopolitical dynamics involving Russia and the West.
The long-term impact of this cyberattack remains to be seen, but the incident underscores Anonymous’ ongoing digital campaign against the Kremlin and its political and corporate allies.
