Ransomware Attack Exposes Major Cybersecurity Weaknesses in Nepal’s Stock Market

A recent ransomware attack has raised serious questions about the cybersecurity infrastructure of Nepal's only stock exchange, the Nepal Stock Exchange (NEPSE), which handles billions of rupees in financial transactions daily. The cyberattack on Data Hub, a private data center, on Asoj 5 forced the temporary shutdown of the country's entire share market, exposing vulnerabilities in the systems used by brokerage companies. The incident has brought attention to the heavy dependence of brokers on shared infrastructure and the lack of adequate investment in independent data storage and backup systems. According to the report, 72 brokerage companies were using trading management systems (TMS) hosted by the same private service provider, Data Hub. Instead of developing independent IT infrastructure and backup facilities, the brokers relied on a common platform, creating a major concentration of cybersecurity risk. Consequently, an attack on a single server disrupted trading operations across the entire market. Following the incident, the Securities Board of Nepal (SEBON) had directed NEPSE to submit a concrete improvement plan within a week. However, the report claims that NEPSE's response focused mainly on basic security measures rather than addressing the underlying structural weaknesses. The proposed measures included conducting Vulnerability Assessment and Penetration Testing (VAPT) every three months, implementing multi-factor authentication, installing licensed antivirus software, and providing cybersecurity training to employees. However, the report highlights that the recommendations did not adequately address the risks associated with all 72 brokers depending on a single infrastructure provider. It also raises questions about accountability and possible action against brokers that fail to develop independent systems. The attack was reportedly detected at around 5:30 AM on Asoj 4. As the following day was a public holiday, the incident did not immediately disrupt regular market operations. On Monday, NEPSE disconnected the TMS systems as a precautionary measure, resulting in the closure of the stock market. The attackers reportedly demanded a ransom to unlock the encrypted files. However, data stored at the Disaster Recovery (DR) Center in Butwal remained safe, as the backup available until Friday had not been affected. Data Hub subsequently restored the information from the backup, allowing the market to resume operations the following day. The incident has raised concerns about the possibility of permanent data loss if the backup system had also been compromised. It has also highlighted the need for stronger cybersecurity infrastructure, independent backup arrangements, risk diversification, and stricter regulatory oversight. The report further emphasizes that Nepal's capital market could remain vulnerable to similar cyberattacks unless brokerage firms and regulatory authorities take more comprehensive measures to strengthen their digital infrastructure and protect investors' financial information.