SriLankan Airlines has issued a categorical denial that its IT systems were hacked, rejecting the claim made in Parliament this week that the national carrier’s software is under the control of attackers.

In a statement carried on Wednesday afternoon, the airline said it “strongly rejects” recent media reports and public statements alleging unauthorised access to its information technology systems, the copying of data, serious damage, or that the airline is under hackers’ control.

The denial answers the central gap in this desk’s report on Tuesday’s parliamentary allegation, which recorded that no response from the airline, the ministry or any cybersecurity authority had been published.

What the airline says it found

The statement sets out a sequence rather than a bare denial.

The allegations, SriLankan says, relate to cybersecurity claims published by various parties on 29 June 2026. On becoming aware of them, the airline says it immediately carried out investigations, technical assessments and precautionary measures.

Those investigations, it says, did not establish any of the following:

The airline adds that its systems and services — including email — operated without interruption, and that at no point were its operations or service continuity affected. That is a direct contradiction of the specific claim made in the House that staff email had been hacked.

The ransom question

On the point the Tuesday report left open, the airline is unambiguous. It says no party demanded a ransom — not in Bitcoin, not in US dollars, not in any other form — and that no discussion of any such payment or negotiation took place.

This matters because the allegation had by then acquired a figure. Reporting on MP Dayasiri Jayasekera’s parliamentary claim put the demand at US$50,000 in cryptocurrency, said the compromise dated to June 2026, and said the attackers had claimed responsibility on the dark web. The airline’s denial addresses that account directly: the June date matches, and the ransom is denied outright.

Two accounts that cannot both be right

The positions are now squarely opposed, and readers should see the difference in kind between them.

On one side is an assertion made on the floor of Parliament by an opposition MP, with no evidence cited. On the other is a formal statement by the organisation whose systems are in question, reporting the outcome of its own internal investigation.

Neither is independent. The airline is not a neutral party to a question about its own security, and a self-investigation reporting that nothing happened is not the same as an external audit. Equally, a parliamentary allegation is not evidence. No independent technical assessment by the Sri Lanka CERT, the ministry, or any third party has been published by either side.

What is now established is the shape of the dispute and its timeline: a claim first aired externally on 29 June, raised in Parliament on 20 October, and denied in full on 21 October.

The airline closed by saying it remains committed to securing its information systems and to the reliability of its services for passengers, staff and business partners.

Not reported

Neither filing names the parties who made the 29 June claims, nor says what was published then or where. Neither says who conducted the airline’s investigation — internal staff or an external firm — when it concluded, or whether its findings will be released.

Neither addresses the offer of United States assistance that Jayasekera urged the government to accept, and neither reports any comment from the Ministry responsible for the airline, the Sri Lanka CERT, or the government. No regulator has said whether the matter was reported to it, as a confirmed breach of passenger data ordinarily would be.

This remains distinct from the fraudulent SriLankan Airlines apps and WhatsApp scams reported earlier in October, which involved criminals impersonating the airline’s brand rather than any access to its own systems.