Sri Lanka Water Board SMS portal compromised in cyberattack
Take action: If the claims of no customer data breach are true it means that some API key was leaked so the attackers only got access to the SMS gateway.
Learn More
The National Water Supply and Drainage Board (NWSDB) of Sri Lanka was hit by a cyberattack on its SMS communication system on Sunday, June 1, 2025, when an unauthorized individual gained access to the agency's website and SMS gateway.
The attackers accessed the SMS portal and sent approximately 10,000 fraudulent messages to customers falsely claiming that their water board accounts had been hacked. The malicious messages stated: "Your Waterboard account has been hacked by Alpha Team… Your data can recover if we got 1.5 BTC" and included a Bitcoin wallet address for ransom payment.
Despite the security breach of the SMS system, NWSDB officials claim that no customer data was compromised during the incident. It's unclear how the attackers knew the phone numbers if no data is breached.
Approximately 10,000 fraudulent messages were sent to customers' mobile phones. The exact number of customers who received these deceptive texts has not been disclosed by authorities.
