Sri Lankan Pensions Department hit by ransomware attack, 617GB of data exposed
Learn More
The Sri Lanka Department of Pensions, a government agency responsible for managing pension schemes for public sector employees, was hit by ransomware attack orchestrated by the Cloak Ransomware group.
The breach was first reported to the Sri Lanka Computer Emergency Readiness Team (SLCERT) on April 2, 2025. The attack followed a pattern consistent with modern ransomware operations, where hackers stole data and encrypted the compromised files.
The Cloak Ransomware group posted about an unidentified victim using the partial domain "pe*.lk" on dark web forums. The situation escalated on May 26, 2025 when the group revealed the full domain name and uploaded more than 617GB of compromised data for download on their dark web portal.
The exposed data includes
- Names
- Addresses
- ID copies
- Bank details
- Personal identification information
The number of affected individuals has not been disclosed.
The department claims that no data was lost from their servers and that pension services remained unaffected throughout the incident.
SLCERT and the Computer Crimes Investigation Division are investigating the security vulnerabilities that enabled the attack. As a precautionary measure, the department has sent warning messages to registered pensioners, strictly advising them not to share One-Time Passwords (OTPs) or sensitive financial information with third parties,
