Ransomware attack disables Sri Lankan government email infrastructure and destroys stored correspondence

On August 26, 2023, a ransomware attack targeted government email infrastructure managed by Sri Lanka's Information and Communication Technology Agency. The attack encrypted Microsoft Exchange systems associated with the gov.lk government email service and affected backup data. Authorities reported that approximately 5,000 government email accounts were affected, including accounts associated with central government institutions. The service was reportedly restored within approximately twelve hours, but a substantial period of stored government correspondence could not be recovered because complete backups were unavailable. The incident materially interrupted the government-managed email service and caused persistent loss of information supporting government administrative workflows.