ICTA confirms data loss of “gov.lk” email domains

The Information and Communication Technology Agency (ICTA) has officially confirmed a severe data loss incident affecting all government offices using the “gov.lk” email domain.

Issuing a notice in this regard, the Director for Strategic Communications at ICTA confirmed that several  government offices using the “gov.lk” email domain including the Cabinet Office, was affected by the data loss which is believed to have been caused by a large-scale ransomware attack between 17 May and 26 August 26.

Approximately 5,000 email addresses were impacted by the ransomware attack, ICTA reported, adding that as there was neither an offline nor online backup system for a critical period of two months, several emails that were lost due to the attack are now irrecoverable. 

Accordingly, in response to this incident, ICTA has decided to institute daily offline backup process, while the relevant application process will also be upgraded to the latest version with enhanced defenses against virus attacks.

Meanwhile, efforts to recover the lost data are currently underway by both ICTA and the Sri Lanka Computer Emergency Readiness Team (SLCERT).

Meanwhile, SLCERT has also warned the public of a phishing scam specifically targeting Sri Lankan nationals: