A ransomware hit on Data Hub has stopped trading for 72 stockbrokers, forcing NEPSE to freeze the market and raising urgent questions about the safety of Nepal's financial data systems.
Trading on the Nepal Stock Exchange (NEPSE) stopped cold after a ransomware attack hit the core of the country's financial system. The breach at Data Hub Pvt. Ltd., which runs trading systems for 72 stockbrokers, left the market frozen and showed just how weak Nepal's digital defenses are.
Market frozen after cyberattack
The trouble started early Sunday. Data Hub spotted the ransomware at about 5:30 am. The company had already made a full backup at 4 am. That backup could be key to getting things running again. Once the attack hit, Data Hub took all affected systems offline right away. This stopped the ransomware from spreading but also cut brokers off from the tools they need to trade.
Brokers offline, trading stopped
YCO Pvt. Ltd., which manages the brokers' trading platforms, said the ransomware knocked out the Trading Management System (TMS), CDS and Clearing, payment gateways, and other linked services. The Stock Brokers Association of Nepal, facing a total shutdown, asked NEPSE to halt trading. They warned of serious cybersecurity and data risks. NEPSE agreed and announced a full trading stop for Monday. The exchange said trading would not restart until the breach was fixed, warning that trying to reopen too soon could put NEPSE's own systems at risk. This halt followed Rule 21(1) of the Securities Listing and Trading Regulations, 2018. NEPSE apologized to investors and said trading would only start again once the technical problem was solved.
The disruption affected the trading infrastructure of 72 brokerage firms whose servers are hosted at Data Hub Pvt. Ltd., according to multiple Nepali outlets citing NEPSE's notice.
Investigation underway, many questions remain
Data Hub has not said which ransomware group was behind the attack. It has not shared if there was a ransom demand or if any data was stolen. Forensic teams are now checking all affected systems, which remain cut off from the network. The company says its backup from before the attack is safe and untouched. But there is no clear timeline for when things will be back to normal. The market might not reopen on Tuesday. That depends on whether the systems are proven safe and stable. As of 21 September 2026, work to restore systems and the investigation were still ongoing. There was still no official date for trading to resume.
Shockwaves across Nepal's financial sector
The damage goes beyond just one lost trading day. Because the data center connects directly to NEPSE, there is a real risk the problem could spread to the wider trading system. YCO warned that reopening too soon could make things worse. This echoes other big ransomware attacks in finance and healthcare. As reported earlier, ransomware has forced key institutions to shut down services before, showing how much chaos follows when digital systems are hit.
This incident is a wake-up call for Nepal's financial sector. The ability to keep markets running now depends on strong cybersecurity. A single breach at a third-party data center was enough to freeze the whole national exchange. This shows a deep weakness that can't be ignored. Until Data Hub and its partners can prove their systems are safe, the risk of more shutdowns will hang over the market and shake investor trust.
