The Information and Communication Technology Agency (ICTA) has officially confirmed that there has been a significant data loss incident affecting all government offices using the "gov.lk" email domain.
In an official notice, the Director for Strategic Communications at ICTA confirmed that the data loss incident, believed to be caused by a large-scale ransomware attack, has impacted several government offices, including the Cabinet Office.
The attack took place between May 17 and August 26. Around 5,000 email addresses were affected by the ransomware attack, according to ICTA.
Due to the lack of both offline and online backup systems during a critical two-month period, some of the lost emails are irrecoverable. In response to this incident, ICTA has decided to implement a daily offline backup process.
In addition, the relevant application process will be upgraded to the latest version with enhanced defenses against virus attacks. Efforts are currently underway by both ICTA and the Sri Lanka Computer Emergency Readiness Team (SLCERT) to recover the lost data.
In the meantime, SLCERT has issued a warning to the public about a phishing scam specifically targeting Sri Lankan nationals.
