SriLankan Airlines has found itself at the center of a serious cybersecurity controversy after Opposition Member of Parliament Dayasiri Jayasekara alleged that hackers successfully breached the national carrier's computer systems and subsequently demanded a ransom of USD 50,000. The allegation has sent shockwaves through Sri Lanka's aviation and technology sectors, raising urgent questions about the country's cybersecurity preparedness and the safety of sensitive data held by state-owned enterprises.
What Dayasiri Jayasekara Alleged in Parliament
Opposition MP Dayasiri Jayasekara brought the alarming incident to public attention, claiming that cybercriminals had successfully infiltrated SriLankan Airlines' internal computer systems. According to his allegations, the hackers did not merely gain unauthorized access — they escalated the situation by issuing a ransom demand of USD 50,000 in exchange for restoring access or refraining from exposing or destroying compromised data. Jayasekara's decision to raise the matter publicly underscores growing concerns among lawmakers about the vulnerability of Sri Lanka's state institutions to cyber threats. The MP has called for a full and transparent investigation into the breach, demanding accountability from both the airline's management and relevant government authorities.
The Scale of the Alleged Breach
While full technical details of the cyberattack have not yet been officially confirmed by SriLankan Airlines, the nature of the alleged breach points to what cybersecurity experts would classify as a ransomware or extortion-style attack. Such attacks typically involve hackers gaining entry into an organization's network, encrypting or stealing critical data, and then demanding payment — often in cryptocurrency — to restore normal operations or prevent data from being leaked publicly.
SriLankan Airlines, as the national carrier of Sri Lanka, holds a vast repository of sensitive information. This includes passenger personal data, financial records, employee information, and operational systems that are critical to the functioning of the airline. A successful breach of such systems could have far-reaching consequences not only for the airline itself but also for thousands of passengers and stakeholders who trust the carrier with their personal and financial information.
Cybersecurity Vulnerabilities in Sri Lanka's Public Sector
The alleged attack on SriLankan Airlines is not an isolated incident in the broader context of cybersecurity challenges facing Sri Lanka's public institutions. Over recent years, state-owned enterprises and government bodies across the country have faced increasing scrutiny over their digital infrastructure and data protection protocols. Cybercriminals have increasingly targeted airlines and aviation-related entities worldwide, recognizing them as high-value targets that are likely to pay ransoms quickly to avoid operational disruptions.
Experts in the cybersecurity field have long warned that many public sector organizations in developing nations remain significantly underprepared for sophisticated cyberattacks. Outdated software systems, insufficient investment in cybersecurity personnel, and a lack of robust incident response plans can leave critical infrastructure dangerously exposed. If the allegations made by MP Jayasekara are confirmed, it would highlight a significant gap in SriLankan Airlines' digital defenses that urgently needs to be addressed.
SriLankan Airlines Yet to Issue Official Response
As of the time of reporting, SriLankan Airlines had not released a comprehensive official statement addressing the specific allegations made by Dayasiri Jayasekara. The absence of a clear and transparent response from the airline's management has only fueled public concern and speculation. Stakeholders, including passengers, employees, and industry observers, are awaiting confirmation or denial of the breach, along with details of what steps, if any, are being taken to secure the airline's systems and protect affected data.
Transparency in such situations is considered critical. Cybersecurity professionals consistently advise that organizations respond to breach allegations swiftly and openly, both to maintain public trust and to demonstrate a commitment to accountability. Delays or evasive responses can significantly worsen reputational damage and erode confidence among customers and partners.
Political and Governance Implications
The fact that this allegation has emerged from within Parliament gives the matter significant political weight. MP Jayasekara's public disclosure puts pressure on the government to treat the alleged cyberattack as a matter of national importance rather than an internal administrative issue. Sri Lanka's aviation sector is a vital component of the country's economic recovery strategy, particularly as the nation continues to rebuild its tourism industry. Any credible threat to the integrity of SriLankan Airlines' systems has implications that extend well beyond the airline itself.
Parliamentary oversight of state-owned enterprises on cybersecurity matters is increasingly being recognized globally as a necessary governance measure. This incident may well prompt broader legislative discussions about mandatory cybersecurity standards for all government-linked institutions in Sri Lanka.
What Happens Next
The coming days will be critical in determining how both SriLankan Airlines and the Sri Lankan government respond to these serious allegations. A thorough, independent investigation into the alleged breach is essential to establish the facts, identify the perpetrators, assess the extent of any data compromise, and implement corrective measures. Sri Lanka's citizens and the international aviation community will be watching closely to see whether accountability and transparency prevail in handling this significant cybersecurity incident.