Published 21 September 2026 (5 Asoj 2083). Developing story. Facts below are attributed to their sources; where we checked something ourselves, we say so. We will update this page as official statements come in.
Quick answer: Nepal’s share market has been knocked offline by a ransomware attack on the data centre of Data Hub Pvt. Ltd., which hosts the Trading Management System (TMS) used by brokers. TechPana reported on 5 Asoj that Data Hub confirmed the attack and that TMS, CDSC-related systems and payment gateways were taken offline. NEPSE suspended trading, and the Kathmandu Post reports that servers of 72 stockbrokers are hosted at the affected data centre. When we checked broker TMS portals ourselves on 21 September, they were returning 503 Service Unavailable or not responding at all.
What is confirmed, and by whom
| Claim | Source |
|---|---|
| Ransomware attack on Data Hub’s data centre; TMS, CDSC-related systems and payment gateways taken offline; forensic analysis under way | TechPana, 5 Asoj 2083, reporting Data Hub’s confirmation |
| TMS developer Waiko (Wiko) informed the Stock Brokers Association of Nepal in writing about the attack | TechPana; Bajarko Chirfar; Nepali market portals, 5–6 Asoj |
| Attack detected around 5:30 am; a full system backup finished at 4:00 am was “secure and isolated” | TechPana, citing the notification to brokers |
| NEPSE suspended trading; 72 brokers’ servers sit in the affected data centre; suspension requested by the Stock Brokers Association under Rule 21(1) of the Securities Listing and Trading Regulations, 2018 | The Kathmandu Post, 21 September 2026 |
| Broker TMS portals unreachable (503 / no response) | Digital Solution’s own check, 21 September 2026 |
Important nuance: NEPSE’s own public notice describes a technical problem at the data centre and warns that continuing to trade could damage its trading system. The word ransomware comes from the vendor’s letter to brokers and Data Hub’s confirmation as reported by Nepali media — not, so far, from a NEPSE press statement.
What is not known yet
- Who did it. No ransomware group has been named publicly.
- Whether any ransom was demanded or paid. No figure has been made public.
- Whether investor data was stolen. Reports so far describe systems being encrypted and taken offline; none confirms data exfiltration. Absence of confirmation is not proof either way.
- When trading resumes. No restoration date had been announced at the time of writing; Data Hub said systems restart only after forensic analysis and hardening.
- Which payment gateways were affected. Reports mention payment gateways without naming them; we could not independently verify which.
Timeline so far
| When | What |
|---|---|
| Sunday morning, 4 Asoj (20 Sep) | Trading system problems begin; full backup completed 4:00 am; attack detected around 5:30 am (per reports) |
| 4 Asoj, 12:28 pm | TechPana reports Data Hub confirming a ransomware attack; TMS, CDSC-related systems and payment gateways offline |
| 5 Asoj (21 Sep) | NEPSE suspends Monday’s trading at the Brokers Association’s request; 72 brokers affected |
| 5 Asoj, afternoon | Broker TMS portals still unreachable when we checked |
What investors should do right now
- Do not panic about your shares. Your holdings are records in the depository system, not files on a broker’s web server. An outage stops trading; it does not delete ownership.
- Expect scams within days. Every large Nepali outage is followed by fake “system restored, verify your account” messages. Treat any SMS, Viber, WhatsApp or email asking you to log in through a link as fraud.
- Only use official addresses. Reach your broker’s TMS through the address they have always given you, or through NEPSE’s official site — never through a link in a message.
- Never share your TMS or MeroShare password, PIN, OTP or DP details with anyone who calls claiming to be “support”, your broker, CDSC or SEBON. Legitimate staff never ask for them.
- Change passwords after services are restored — not during the outage, and only on the official site. Use a different password from the one you use for email and banking.
- Keep your own records. Screenshot or save your latest holdings and any pending orders, so you can compare after restoration.
- Watch official channels only: NEPSE, SEBON, CDSC and your broker’s verified pages for the restart announcement.
The bigger lesson: vendor risk is your risk
This incident is a textbook single point of failure. Dozens of licensed brokers, the trading system they depend on and related services were all sitting in one third-party data centre — so one compromise took the market down with it. Three things are worth noticing:
- Backups saved the day, because they were isolated. The reported 4:00 am backup that stayed clean is the difference between “restore and reopen” and “rebuild from nothing”. Ransomware crews specifically hunt for backups connected to the same network.
- Concentration is a systemic risk, not just a company’s problem. When 72 brokers share one hosting provider, the regulator’s exposure is the provider’s weakest control.
- Recovery is slow on purpose. Restarting before forensics is how organisations get hit a second time through the same hole.
For Nepali businesses, the practical takeaway is unglamorous: keep offline, tested backups, separate your admin accounts, and ask your hosting or software vendor what their incident plan is before you need it. Our guides on what never to upload and spotting online scams in Nepal cover the everyday side of this.
🔐 आफ्नो business को data सुरक्षित छ?
Backup, password policy वा digital security बारे बुझ्नुपर्ने भए Digital Solution लाई सोध्नुहोस्।
Frequently asked questions
Is the NEPSE share market closed because of a cyber attack?
NEPSE suspended trading because of the data centre failure. Data Hub confirmed a ransomware attack according to TechPana’s reporting and the vendor’s letter to brokers; NEPSE’s own notice refers to a technical problem.
Are my shares safe?
Share ownership is recorded in the depository system, not on the broker portal you log into. An outage blocks trading and access, but it does not by itself erase holdings. Verify your statement once systems are back.
Was investor data stolen?
No confirmation of data theft has been published. Assume nothing either way and be alert for phishing that pretends to be your broker.
When will trading resume?
Not announced. Data Hub said systems restart only after forensic analysis and security work are complete.
What is ransomware, in one line?
Malware that encrypts an organisation’s files and demands payment for the key — which is why clean, isolated backups decide how fast a victim recovers.
Should I change my TMS and MeroShare passwords?
Yes, once services are officially restored, using the official websites — and don’t reuse your email or bank password.
The bottom line
A ransomware hit on one hosting provider has stopped an entire national market — which tells you how much of Nepal’s financial plumbing now runs through a handful of private systems. Watch the official channels for the restart, ignore any “verify your account” message that arrives in the meantime, and if you run a business, treat this as the reminder to check your own backups today.
Sources & disclaimer: TechPana (5 Asoj 2083) reporting Data Hub’s confirmation and the Waiko notification to the Stock Brokers Association; The Kathmandu Post (21 September 2026) on the trading suspension and the 72 affected brokers; Bajarko Chirfar and other Nepali market portals; plus our own availability checks of broker TMS portals on 21 September 2026. Digital Solution Pvt. Ltd. is an independent publisher with no affiliation to NEPSE, CDSC, SEBON, Data Hub or any broker. This is a developing story — official statements prevail over this summary, and we do not give investment advice.
Rabin Paudel
Rabin Paudel is the Founder of Digital Solution, a Content Creator, and an AI Trainer. He shares practical and easy-to-understand content on Artificial Intelligence, Digital Literacy, Online Services, FinTech, and Technology. His mission is to make technology simple, accessible, and useful for everyone.
View all posts by Rabin Paudel →