A Securities Board of Nepal (SEBON) official has criticised the cybersecurity recommendations submitted by the Nepal Stock Exchange (NEPSE) after a ransomware attack disrupted the trading systems of 72 brokerage firms in September, calling them largely superficial and lacking concrete solutions to prevent another major disruption.
As per the view of an official of SEBON. the one-week deadline for the report may have limited the depth of its recommendations. SEBON Chairman Dr Gopal Prasad Bhatta said the board is preparing an information technology policy for the securities market, which he described as nearing completion.
The attack
On Sunday, September 20, Data Hub Pvt Ltd, a data-centre operator hosting systems used by many stockbrokers, detected a ransomware attack. Data Hub informed NEPSE by email and telephone at about 5:30 am. The affected infrastructure hosted the Trade Management System used by 72 brokerage firms, leaving them unable to trade through their terminals.
On Monday, September 21, NEPSE suspended the entire day’s trading, citing the risk to its own connected infrastructure and the unfairness of letting some investors trade while others could not. Trading resumed on September 22 after the systems were restored from backup data held at Data Hub’s disaster recovery centre in Butwal. NEPSE’s central trading engine was separate from the affected infrastructure and was not directly breached.
SEBON ordered NEPSE to investigate and submit recommendations within a week, and separately deployed a five-member inspection team led by a deputy executive director. No final report from that team has been made public.
What NEPSE recommended
NEPSE’s report proposes regular IT audits, vulnerability tests every three months, separate and secure backups taken regularly or in real time, multi-factor authentication and cybersecurity training for staff. It also recommends licensed antivirus software, awareness of suspicious emails and messages, and minimum cybersecurity standards for organisations connected to the capital market.
Some of these are basic protections. Multi-factor authentication makes it harder to use a stolen password, and tested backups help recovery. But they do not by themselves address how attackers entered, how the attack spread or whether the arrangements can be enforced.
Why the criticism matters
Nepal had about 90 actively operating brokerage firms, and 72 used Data Hub’s infrastructure, so one provider’s failure could stop most of the market.
Experts and regulators typically look for independent forensic investigation, separation of networks, backups isolated from the main system, tested restoration, and defined recovery targets, such as how fast trading must return and how much data loss is tolerable.
SEBON’s wider reforms
On September 29, SEBON announced the Securities Brokerage Business Strengthening Policy, 2026, which introduces a four-class system for brokers, stronger capital and governance rules and tighter technology controls. These include a dedicated information-security function, penetration testing, tested disaster recovery sites with defined recovery targets, a named cybersecurity officer and time-bound reporting of cyber incidents. It also gives the regulator, NEPSE and brokers emergency authority to halt trading. Further directives are needed before all provisions can be enforced.
On September 30, Bhatta told the parliamentary Finance Committee that around 31 to 32 new regulatory arrangements had been drafted on trading mechanisms, order management, cybersecurity and IT policy. The Ministry of Finance has also issued a 21-point directive on capital-market reform, including technology upgrades at CDS and Clearing Ltd.
A pattern of technical failures
The attack followed other disruptions, which were not cyberattacks. On February 17, the NEPSE index appeared to fall by 885.32 points, or 33.34 percent, after some closing prices were shown as zero. On July 23, the website and trading system showed an apparent fall of about 1,008 points, or 37 percent, after trading closed. Both were attributed to technical errors rather than real market movements. Together they have raised questions about investor confidence in the exchange’s technology.
The cause and method of the attack, whether data was stolen, who bears responsibility, and when the IT policy will take effect and how it will be enforced, however, are yet to be established.
