SriLankan Airlines has rejected parliamentary allegations that hackers compromised its computer systems and demanded a US$50,000 ransom. The national carrier maintains that its investigations found no unauthorised access, data theft or disruption to operations. The denial is categorical, but the controversy raises important questions about cybersecurity, public accountability and the protection of passenger information.
When Opposition MP Dayasiri Jayasekara told Parliament that hackers had allegedly penetrated SriLankan Airlines’ computer systems and demanded a ransom of US$50,000 in cryptocurrency, the claims were sufficiently serious to demand an immediate response. An airline’s information technology infrastructure is not merely another collection of corporate computers. It supports reservations, passenger records, financial transactions, internal communications and essential operational functions. Any credible allegation that such systems have been compromised therefore carries implications extending well beyond the company itself.
SriLankan Airlines responded on Wednesday with an unequivocal denial. The airline said the allegations appeared to originate from an external cyber-related claim published on June 29 and maintained that subsequent investigations found no evidence of unauthorised access to its systems. Management also rejected suggestions that passenger or operational information had been stolen, that services had been disrupted or that the airline had received a ransom demand. According to the company, no negotiations with alleged hackers took place.
Submit Your Press Release
Get your company news, announcements, launches, appointments and events in front of a wider audience.
Those statements are important and must be accurately reflected in any assessment of the controversy. Parliamentary privilege allows elected representatives to raise matters of public concern, but it does not automatically establish the accuracy of allegations made under its protection. Equally, a corporate denial does not eliminate the public interest in understanding how the allegations were investigated and what technical safeguards exist. The responsible approach is to examine the available evidence rather than presume either that the airline was compromised or that every concern has been conclusively resolved.
The distinction matters particularly in cybersecurity, where the absence of visible disruption does not necessarily establish the absence of an attempted intrusion. Sophisticated attacks can involve unauthorised access to email accounts, extraction of information or exploitation of vulnerabilities without immediately affecting passenger services. Conversely, criminal groups sometimes make exaggerated or entirely fabricated claims about possessing confidential information. Establishing the truth requires technical examination rather than political assertion.
SriLankan Airlines should therefore consider whether it can provide an independently verifiable account of the investigation undertaken following the June allegation. That need not involve disclosing sensitive security arrangements or information that could assist potential attackers. A properly framed statement identifying the scope of the examination, the independent expertise involved and the conclusions reached would help establish confidence without compromising security.
The airline’s ownership makes the question particularly relevant to the public. As a State-owned enterprise with substantial financial obligations and an important role in international connectivity, SriLankan Airlines is accountable not only to passengers and commercial partners but also to taxpayers. A serious cybersecurity incident could expose the company to operational disruption, reputational damage and financial liabilities. Preventive investment and independent assurance should therefore be treated as essential components of corporate governance.
The Government must also consider the wider implications for critical national infrastructure. Airlines, ports, financial institutions, hospitals and electricity networks increasingly depend on interconnected digital systems. Their vulnerability to cybercrime cannot be addressed solely through statements issued after allegations become public. Effective protection requires continuous assessment, clearly defined reporting obligations and credible arrangements for responding to incidents.
Be that as it may, SriLankan Airlines has denied the allegations, and that denial deserves proper weight. Those who made the claims must also be prepared to substantiate them. The public interest is not served by sensational accusations that cannot be supported, but neither is it served by a culture in which assurances are expected to replace independent scrutiny.
The immediate question is whether the airline can demonstrate that its systems were adequately examined and that the information entrusted to it remains secure. For passengers, employees and taxpayers, that assurance matters considerably more than the political argument surrounding the original allegation.
