Nepal Stock Market Trading Halted After Cyberattack on Data Center

Trading at the Nepal Stock Exchange (NEPSE) was halted on Monday after a cyberattack disrupted the data infrastructure used by a large number of stockbrokers.

The market had been scheduled to reopen following a two-day public holiday. However, NEPSE issued a notice postponing trading after discovering that a significant portion of brokers' transaction-related data had been affected by the incident.

Cyberattack Affects Data Used by Majority of Brokers

Nepal currently has 90 stockbroker companies, with their client and transaction data managed through two major data centers.

According to NEPSE spokesperson Murahari Parajuli, Data Hub manages data infrastructure for 72 brokers, while Himalayan Cloud provides similar services to the remaining 18 brokers.

Because the cyber incident affected the infrastructure used by most brokers, NEPSE decided to suspend trading rather than reopen the market under uncertain technical conditions.

Data Hub subsequently confirmed that its infrastructure had been hit by a ransomware attack. In such attacks, cybercriminals typically encrypt or otherwise restrict access to systems and demand payment in exchange for restoring access.

Data Hub Confirms Ransomware Incident

Data Hub formally acknowledged the cyberattack through an official communication issued on Monday.

According to Assistant General Manager Navinmuni Bajracharya, the ransomware incident occurred at approximately 5:30 AM on October 4.

The company said a backup created at around 4:00 AM, approximately 90 minutes before the incident, remained secure and had been stored separately from the affected system.

However, questions remain about the precise method used to restore the affected infrastructure and recover access to the data.

There have been discussions on social media suggesting that the company may have paid the attackers to regain access. There is currently no confirmed evidence establishing that a ransom was paid, and Data Hub has not publicly confirmed such a payment.

Questions Over Cybersecurity Preparedness

The incident has raised concerns about the cybersecurity arrangements surrounding Nepal's capital market.

NEPSE's existing framework places responsibility for data management on individual brokers. However, maintaining independent infrastructure can be expensive, leading brokers to rely on centralized data service providers.

As a result, a cyberattack affecting one major infrastructure provider can potentially disrupt services for a large number of brokers simultaneously.

The latest incident has therefore brought renewed attention to whether the current centralized approach provides sufficient protection against large-scale cyber threats.

Are Investors' Data and Assets Safe?

Preliminary information indicates that the attack involved encryption of data. However, authorities have yet to establish publicly how much information, if any, was extracted from the affected systems.

The distinction is important because encrypting data and stealing data are separate aspects of a ransomware incident. While the former can disrupt operations, the latter could create additional risks involving the exposure of investors' personal and financial information.

The incident has consequently prompted questions about the security of both investor information and the broader infrastructure supporting Nepal's capital market.

Significant Exposure for Nepal's Financial Sector

Nepal's capital market represents a substantial portion of the country's financial ecosystem.

Investor holdings in the market are reported to be worth approximately Rs. 45.65 trillion, equivalent to around 70 percent of Nepal's current gross domestic product.

The scale of these assets highlights why the resilience and cybersecurity of systems supporting stock trading are important not only for brokers and investors but also for the wider financial system.

SEBON and NEPSE Launch Investigations

The Securities Board of Nepal (SEBON) has taken the incident seriously and initiated an internal investigation.

NEPSE has also formed a separate committee to examine the circumstances surrounding the disruption. SEBON has instructed NEPSE to submit a detailed report on the incident within one week.

Meanwhile, the Cyber Bureau of Nepal Police has also begun investigating the cyberattack.

The investigations are expected to determine the nature and extent of the breach, whether any data was stolen, how the systems were restored, and whether additional security measures are required to prevent similar incidents.

The cyberattack on Data Hub has temporarily disrupted Nepal's stock market and exposed the potential risks associated with centralized financial data infrastructure. While the company says an isolated backup remained secure, important questions about the attack, data exposure and system recovery remain under investigation.

The findings from SEBON, NEPSE and the Nepal Police Cyber Bureau will be important in determining the extent of the incident and what measures may be needed to strengthen cybersecurity across Nepal's capital market.