✨ सारांश
- Nepal's capital market and share trading at the Nepal Stock Exchange (NEPSE) were suspended on Monday after a ransomware attack targeted the data center hosting the Trade Management System (TMS).
- The ransomware affected the TMS servers of 72 brokerage companies, as well as CDSC-related and payment systems, prompting concerns over data integrity and cybersecurity.
- Data Hub Pvt. Ltd. stated that the latest backup taken before the attack remains safe and isolated, while forensic analysis and security tests are being conducted before bringing systems back online.
- NEPSE clarified that its main trading system remains safe and unaffected, as the compromised infrastructure was successfully isolated to prevent the threat from spreading.
- The Securities Board of Nepal (SEBON) expressed serious concern, deployed a five-member inspection team, and instructed NEPSE to submit an investigation report with improvement recommendations by Ashoj 12, 2083.
Kathmandu: Nepal’s capital market remained closed on Monday after a ransomware attack was detected at the data center hosting the Trade Management System (TMS), a platform used by around 8 million investors for share trading. Trading at the Nepal Stock Exchange (NEPSE) was halted after ransomware entered the data center where the TMS systems of 72 brokerage companies are hosted.
Trading was suspended after technical and cybersecurity problems at the data center raised concerns that continued trading could potentially affect NEPSE’s main trading system as well.
Broker Ramchandra Bhattarai said that problems had emerged in the TMS, CDSC-related systems and payment systems following the ransomware attack at the data hub. He urged that share trading should not resume until cybersecurity and data integrity are fully ensured. According to him, the problem at the data hub had not yet been resolved, and resuming trading could expose NEPSE’s systems to additional risks.
He said the incident was not merely a routine server outage or technical problem but was linked to a ransomware attack. Therefore, before restoring the systems, it is necessary to verify that the affected servers, networks and other connected systems are secure.
The infrastructure hosted at Data Hub Pvt. Ltd. currently runs the TMS servers of 72 trading-member brokerage companies. After problems were detected from Sunday morning, brokerage companies requested NEPSE to suspend trading. Based on their request, NEPSE suspended regular trading on Monday under Rule 21(1) of the Securities Listing and Trading Regulations, 2075.
According to Data Hub, the ransomware attack on the infrastructure hosting the TMS was identified at around 5:30 a.m. on September 20, corresponding to Ashoj 4. The company said the latest backup, taken at around 4 a.m. before the attack, remains safe and has been kept isolated from other systems.
Ransomware is a form of cyberattack that can encrypt files and data stored on computer systems and disrupt their operation. Following the incident, Data Hub said forensic analysis and necessary security tests were being conducted, and the affected systems would not be immediately brought back online.
Although work is underway to resolve the technical problems, broker Bhattarai said the systems need to remain isolated for some time and therefore cannot be restored immediately. He said the IT team had informed them that a virus had entered the system. Wico and Data Hub, which are involved in managing the TMS infrastructure, have described the incident as a ransomware attack.
Main System Safe: NEPSE
According to NEPSE, the problem occurred not in its main trading system but in the data center being used by brokerage companies to operate their TMS platforms. The affected infrastructure has been isolated to prevent any potential threat from spreading to NEPSE’s trading system.
Data Hub has said forensic analysis must be completed before the affected systems are brought back online. Since there is a possibility that the ransomware may have spread to other connected networks and systems, the process of restoring operations will proceed only after additional security tests are completed. Necessary measures have been taken to protect the trading system under NEPSE’s control.
Investors Concerned
The sudden suspension of trading has raised concerns among investors about the safety of their assets and the reliability of the trading system. Investor Janak Karki said that repeated technical problems and interruptions in trading could increase risks to investors’ assets. He said the immediate concern was not only when the TMS would resume operations but also whether the cyberattack had affected investors’ personal and trading-related information.
Securities Board Begins Investigation
The Securities Board of Nepal (SEBON) has begun an investigation after expressing serious concern over the technical problems affecting securities brokers’ operations. Following Monday’s incident, SEBON has instructed NEPSE to conduct a necessary study and investigation into the reasons that led to the suspension of securities trading and submit a report, including recommendations for improvements, by Ashoj 12, 2083.
SEBON spokesperson Niranjaya Ghimire said the board has also deployed a five-member inspection team led by a deputy executive director to immediately investigate the incident. The team will identify the technical problems and the reasons that led to the suspension of trading. SEBON said necessary measures would be taken to make Nepal’s securities market safer, healthier and more transparent based on recommendations from the inspection team.
