COLOMBO — Regulators are examining a possible June cybersecurity incident and allegations that the national carrier failed to report a potential threat, despite warnings and an offer of assistance from a United States aviation security official.
At least two investigations are underway into a possible cybersecurity breach at SriLankan Airlines and allegations that the national carrier failed to notify aviation regulators after a suspected intrusion into its computer systems on June 29, 2026.
Deputy Aviation Minister Janith Ruuwan Kodituwakku confirmed the inquiries to The Sunday Times, which reported on October 25 that the Civil Aviation Authority of Sri Lanka (CAASL) had not been informed of the suspected incident when it first emerged.
The investigations follow allegations by opposition Parliamentarian Dayasiri Jayasekara that hackers had gained access to the airline’s computer and email systems, claimed responsibility on the dark web and demanded US$50,000 in cryptocurrency.
SriLankan Airlines has categorically denied that its internal systems were compromised. In a statement issued on October 21, the carrier maintained that its investigations had found no unauthorised access, data theft, ransom demand or disruption to operations.
The conflicting accounts have placed the handling of the suspected incident under scrutiny, particularly following reports that the Oneworld airline alliance temporarily disconnected the carrier from its CarrierConnect data-exchange platform.
The issue now extends beyond whether hackers successfully penetrated the airline’s systems to whether management responded appropriately to the initial warning and complied with its regulatory reporting obligations.
Hackers Allegedly Demanded US$50,000 in Cryptocurrency
Speaking in Parliament on October 20, Jayasekara claimed that an unauthorised group had compromised SriLankan Airlines’ software and email infrastructure.
According to the MP, the attackers published material on the dark web claiming responsibility for the intrusion and demanded US$50,000 in cryptocurrency.
He alleged that the airline’s systems remained vulnerable and warned that the attackers could interfere with its operations.
These claims have not been independently established through a published forensic investigation.
The Inter-Company Employees’ Union (ICEU) has separately identified a group calling itself Infrastructure Destruction Squad, also known as Blacknet-00, as the entity behind the alleged incident.
In correspondence sent to SriLankan Airlines’ management, the union stated that the group had published claims on June 29 suggesting that it had penetrated the carrier’s corporate network.
A cybercriminal group’s public assertion that it has breached an organisation does not, by itself, prove that a successful intrusion occurred.
Independent technical evidence is necessary to establish whether unauthorised access took place, which systems were affected and whether any information was extracted.
SriLankan Airlines Denies Breach and Ransom Demand
SriLankan Airlines rejected the allegations in a statement released on October 21.
The carrier acknowledged that an external cybersecurity claim had appeared on June 29 but maintained that it had immediately undertaken investigations, technical assessments and precautionary measures.
According to the airline, those checks found no evidence of unauthorised access to its internal information technology environment or operational systems.
It also denied that information assets had been compromised or that data had been extracted.
The carrier maintained that its email services and other systems continued functioning without interruption and that the allegations had not affected flight operations or service continuity.
Addressing the reported ransom demand, SriLankan Airlines said it had received no request for payment in Bitcoin, US dollars or any other form.
It also denied entering into negotiations with the alleged attackers.
The statement directly contradicts Jayasekara’s parliamentary allegations and the concerns raised by the employees’ union.
However, the airline’s conclusions have not yet been independently reconciled with the regulatory inquiries now underway.
United States Aviation Security Official Reportedly Offered Assistance
One of the most serious questions concerns an alleged warning issued by a United States aviation security official.
According to correspondence from the ICEU, Richard W. Whitmer, Transportation Security Administration (TSA) Attaché at the United States Embassy in Singapore, contacted SriLankan Airlines on June 29.
The union claims that the communication alerted the carrier to a possible cybersecurity breach and offered technical assistance.
It further alleges that senior information technology managers dismissed the warning without commissioning an independent forensic examination.
The original correspondence and the airline’s complete internal response have not been made publicly available for independent assessment.
Consequently, the claim that management deliberately suppressed or disregarded the warning remains an allegation.
Nevertheless, the reported communication raises important questions about the procedures followed after the airline received information concerning a potential threat.
Investigators will need to establish who received the warning, what assessments were undertaken, whether external assistance was considered and which officials authorised the subsequent response.
Oneworld Temporarily Restricts CarrierConnect Access
The reported response by the Oneworld airline alliance has added another dimension to the investigation.
According to The Sunday Times, Oneworld temporarily disconnected the connection between SriLankan Airlines’ client and target endpoints and CarrierConnect, the alliance’s internal data-exchange platform.
CarrierConnect facilitates standardised interline information exchange among participating airlines and partners.
Such an interruption is relevant because international airlines depend on secure digital connections to support cooperation across their networks.
However, the reported restriction does not establish that SriLankan Airlines’ internal systems were successfully breached.
A protective disconnection can be undertaken while a potential security threat is being assessed.
The action should also not be confused with suspension or expulsion from the alliance itself.
No evidence has been presented that SriLankan Airlines lost its Oneworld membership.
The circumstances surrounding the temporary restriction, including its duration and the conditions for restoring normal connectivity, require further clarification from the airline and alliance.
Why Was the Civil Aviation Authority Not Informed?
The regulatory reporting question may prove central to the ongoing inquiries.
The original source refers to Aviation Security Directive No. 009, issued in May 2025, as establishing reporting obligations concerning cybersecurity threats and unusual system failures.
The precise provisions of that directive have not been independently examined for this article.
However, Deputy Aviation Minister Kodituwakku has confirmed that CAASL was not informed when the suspected incident emerged.
According to the account published by The Sunday Times, a forensic team was subsequently dispatched after the regulatory authority became aware of the allegations.
Statements were obtained and forwarded to Sri Lanka CERT for technical examination.
The Deputy Minister questioned why the airline had not alerted the aviation regulator, given that the suspected incident had been serious enough to warrant attention from cybersecurity authorities.
Whether the failure to notify CAASL constituted a breach of a binding directive, and whether any individuals bear responsibility, must be determined through the investigation.
A finding of deliberate concealment would require evidence establishing not only what management knew but also whether officials intentionally withheld information they were legally obliged to report.
Union Demands Independent Forensic Investigation
The ICEU has called for an independent forensic and administrative inquiry into the suspected incident.
In correspondence addressed to SriLankan Airlines’ Acting Chief Executive Officer Vipul Mishra, with copies to relevant government officials, the union raised concerns about cybersecurity management, regulatory compliance and the treatment of employees who questioned the airline’s response.
It also alleged workplace intimidation and retaliatory action against individuals associated with the matter.
Those employment-related accusations have not been independently established.
The union argues that an investigation conducted solely by the department or management personnel whose conduct is being questioned would not provide sufficient assurance of independence.
Its demand for external scrutiny reflects the importance of establishing a reliable sequence of events.
An independent investigation would need to determine whether the June 29 warning was credible, what systems were examined, which security logs were preserved and whether the airline’s original findings were supported by the available technical evidence.
The process would also need to establish whether the incident involved an attempted intrusion, a successful compromise or an unsubstantiated threat.
Passenger Data and Operational Security Remain Key Concerns
The allegations have prompted questions about the protection of passenger information and the airline’s operational systems.
Commercial airline technology environments may process booking information, passenger identification details, payment-related records and operational communications.
The precise systems and data involved in the reported SriLankan Airlines incident have not been publicly identified through an independent forensic report.
There is currently no independently verified evidence in the reporting reviewed that passengers’ passport details, credit card information or travel records were stolen during the alleged June intrusion.
SriLankan Airlines maintains that no information was extracted and no operational services were compromised.
The distinction between a suspected corporate network incident and interference with flight-critical systems is particularly important.
A compromise involving email or administrative infrastructure does not automatically demonstrate that aircraft operations, air traffic systems or flight safety were affected.
Nevertheless, aviation cybersecurity requires close coordination between airlines, regulators and relevant national technical agencies because different systems may be interconnected.
The investigations should therefore address both the reported threat and the adequacy of measures used to protect sensitive information.
Three Questions Authorities Must Answer
As the investigations continue, several issues remain unresolved.
1. What independent technical evidence is available to establish whether SriLankan Airlines’ systems were breached, and can investigators confirm that passenger travel records, passport information and payment-related data remained secure?
2. Which officials received the alleged June 29 warning from the United States TSA representative, what action did they take, and was an independent forensic investigation considered or requested?
3. Why was CAASL not informed when the suspected incident emerged, what reporting obligations applied, and will any administrative or legal action follow if investigators identify non-compliance or deliberate concealment?
These questions require evidence rather than assumptions about either the airline’s conduct or the allegations made against its management.
Regulatory Findings Will Determine Responsibility
The controversy now presents two distinct issues.
First, investigators must determine whether a successful cyber intrusion occurred and whether SriLankan Airlines’ original technical assessment accurately reflected the available evidence.
Second, regulators must establish whether the airline complied with the procedures governing the reporting and investigation of suspected cybersecurity incidents.
A finding that no successful breach occurred would not necessarily resolve every question concerning how a credible warning was handled.
Conversely, the existence of a cybersecurity warning or temporary precautionary restriction by an airline alliance does not establish that management concealed a successful attack.
The ongoing inquiries by CAASL and the relevant cybersecurity authorities will be essential in resolving those distinctions.
For a national carrier entrusted with passenger information and international aviation responsibilities, confidence depends on transparent reporting, credible technical assessments and effective regulatory oversight.
The immediate priority is to establish what happened on June 29, whether the response met the required standards and whether any weaknesses identified by investigators have been corrected.
