Ransomware at a Nepali data centre halts share trading for a day

What happened

Data Hub said the attack was detected early on Sunday, between about 4 am and 5:30 am. Data Hub has operated since 2012 and hosts data for more than 1,000 companies, according to Onlinekhabar. Among them were the servers of 72 brokerage firms. The Kathmandu Post reported that 90 broker firms are currently operating, so the other 18, hosted elsewhere, were not affected. Nepal Stock Exchange, known as NEPSE, at first described the problem as technical. A letter from Data Hub to the trading software company later called it ransomware.

YCo, the company that manages the brokers' trading systems, told brokers that the incident affected the trading management system, the central depository and clearing systems, payment gateways and other connected services. It isolated the affected systems and warned that continuing to trade through the network link to NEPSE could add risk. The problem was still unresolved on Monday morning. After a written request from the Stock Brokers Association, NEPSE halted trading for the whole day. The 18 unaffected brokers asked to continue, but NEPSE refused.

On Monday evening, the NEPSE board agreed not to suspend trading again on Tuesday, even if the Data Hub problem continued. Systems were restored and trading resumed on Tuesday. The Securities Board of Nepal, the market regulator, sent a five-member inspection team and asked NEPSE to study the incident and submit a report with recommendations by 28 September. The Kathmandu Post put investor assets at stake in the market at 4.5 trillion rupees or more.

The engineering behind it

Ransomware is malicious software that encrypts files so their owner can no longer use them. Onlinekhabar explained that attackers usually leave a note demanding payment for the decryption key. In double extortion, they also steal data first and threaten to publish it. A senior Data Hub official said no ransom note was left, while cybersecurity expert Naresh Lamgade, founder of BugV, said a note may exist without being made public. Who carried out the attack was not known, and neither was whether any data was copied.

Recovery depended on preparation made long before the attack. Data Hub formatted the encrypted machines and restored them from backups kept at its disaster-recovery centre in Butwal, in a different city from the main site. The official said no data was lost. In general, a backup only protects against ransomware if the attacker cannot reach and encrypt it too, which is why backups are often kept offline or on separate networks. A second site in another city also protects against fire, flood or power failure.

Experts quoted by Onlinekhabar raised further questions. Lamgade called it a systematic, planned attack and said other customers' systems in the same data centre should also be checked. Another expert said attacks of this size usually follow a period of quiet exploration, so the attackers may have had access well before Sunday. A forensic investigation would need to establish how long they were inside, how they got in, and whether Data Hub or the brokers were responsible for managing the affected servers.

Onlinekhabar placed the attack among well-known cases abroad. In May 2021 a ransomware attack on Colonial Pipeline in the United States led to a ransom of about 4.4 million dollars. In November 2023 an attack on the US arm of the Chinese bank ICBC disrupted settlement of trades in the US Treasury market. In 2024 an attack on C-Edge Technologies in India affected hundreds of small banks. In each case, one service provider sat underneath many other organisations.

What it means in Nepal

The attack showed how one shared facility can become a single point of failure. One data centre hosted the trading systems of most of the country's brokers, so one incident stopped the whole market for a day. The Kathmandu Post reported that this was not NEPSE's first technical problem in 2026. In February and again in July, the index displayed false drops of more than 30 percent because of data errors. Market expert Niraj Giri, a former regulator, said the repeated problems come from a lack of long-term planning.

Onlinekhabar noted that Nepal's rules restrict banks and payment providers from storing certain data abroad, so banks, insurers and digital wallet companies rely on domestic data centres. That makes the security of a few local facilities important for much of the financial system. Former broker association president Narendra Raj Sijapati told the Post that a small number of business groups control key market infrastructure, and that responsibility gets passed around when something fails.

For engineering students, the case is a local example of ideas that are often taught with foreign examples. Separate backups, a second site in another city and isolating affected systems quickly are what allowed trading to restart within a day. Questions about who manages which server, how attackers got in and how long they stayed are the everyday work of incident response, and Nepali institutions will need engineers who can answer them.