At least two investigations are under way into a possible serious cybersecurity breach at SriLankan Airlines earlier this year and into why the airline did not immediately notify the Civil Aviation Authority of Sri Lanka (CAASL), Deputy Aviation Minister Janith Ruuwan Kodituwakku said.
Opposition MP Dayasiri Jayasekera told Parliament that the airline’s software and email systems had been compromised and that hackers had posted a responsibility-claim video on the dark web demanding US$50,000 in cryptocurrency.
SriLankan Airlines has categorically denied that “its information technology (IT) systems were hacked, hijacked or otherwise compromised, or that the airline is under the control of hackers.” Following the reports, the Oneworld alliance temporarily cut off the link between SriLankan Airlines’ client and target endpoints and CarrierConnect—the alliance’s internal digital platform for standardised interline data exchange. The interruption was “for a short while,” Deputy Minister Kodituwakku said, and was restored after official intervention.
The Sri Lanka Computer Emergency Readiness Team (SLCERT) is currently investigating, the deputy minister said, and authorities remain unclear whether the incident was an actual hack or a threat. CAASL has asked for an explanation as to why it was not notified immediately; several letters have been exchanged but, according to authoritative sources, none of the airline’s explanations have met the regulator’s reporting criteria.
Aviation Security Directive 009, issued in May 2025, states: “The company or department should establish a mechanism for reporting suspicious activities, vulnerabilities, thefts, or tampering with hardware and software files within the organisation.” It also says: “Any incident must be reported to CAASL immediately via the following online line: https://portal.caa.lk/avsec-reporting/index.php.”
SriLankan Airlines’ response and technical actions
In a media communique, SriLankan Airlines said, “Upon becoming aware of the claim made on 29 June 2026, SriLankan Airlines immediately undertook the necessary investigations, technical assessments and precautionary measures.” Deputy Minister Kodituwakku said that the fact the airline informed SLCERT indicates some incident occurred and therefore it should have been notified to CAASL immediately.
Regulatory scrutiny and union demands
Nisal Adikari, head of SriLankan Airlines’ branch of the Janatha Vimukthi Peramuna-affiliated Inter Company Employees’ Union (ICEU), said, “The airline is dragging this matter and not allowing for a proper investigation to take place,” and called it a cover-up.
Deputy Minister Weerakoon said, “The government is giving serious attention to this matter,” and added that the regulatory body is obliged to act when such incidents occur. He said that once CAASL learned of the event a forensic team was sent and statements were taken and those were forwarded to SLCERT.
Earlier this month the ICEU wrote to SriLankan Acting CEO Vipul Mishra, with copies to relevant ministers and other officials, demanding an independent forensic and administrative inquiry into “systemic cybersecurity breaches, statutory non-compliance, workplace intimidation, and retaliatory constructive termination.” The union’s letter says that on June 29 an international cyber-threat entity operating under the designation “Infrastructure Destruction Squad” (alias “Blacknet-00”) published “actionable claims of having penetrated the corporate network infrastructure of SriLankan Airlines.” The letter also says the same day the airline received an urgent formal communication from Richard W. Whitmer, Transportation Security Administration (TSA) Attaché of the Embassy of the United States in Singapore, alerting SriLankan of “an alleged cybersecurity breach and offered assistance.” According to the union, senior IT management “dismissed and suppressed this vital intervention by summarily claiming that no evidence of compromise existed, without conducting an independent forensic audit.”
The ICEU states, “Under Sri Lankan law and aviation standards, internal management cannot investigate itself where serious allegations of misconduct, cyber sabotage, and cover-ups involve the highest levels of the department,” and formally demands a full independent forensic inquiry on statutory and procedural grounds, citing Aviation Safety & Critical Infrastructure Protection (Civil Aviation Act No. 14 of 2010).
