SEBON Investigates Suspension of Share Trading After a Ransomware Attack Disrupted the Data Hub Server

22nd September 2026, Kathmandu

SEBON forms a 5-member probe team following the suspension of share trading after a ransomware attack disrupted the Data Hub server hosting 72 brokerages in Nepal.

SEBON Investigates Suspension of Share Trading

The Securities Board of Nepal (SEBON) has launched a high-level probe into the suspension of share trading after a ransomware attack disrupted the Data Hub server, affecting 72 out of Nepal’s 92 registered stock brokerage firms. The cyber security breach forced an emergency halt to trading operations across the Nepal Stock Exchange (NEPSE), raising widespread concern among millions of capital market investors.

In response to the disruption, SEBON has formed a five-member inspection committee led by an Executive Director to investigate the root technical causes, review security protocols, and recommend preventative measures for Nepal’s stock market infrastructure.

SEBON Forms Probe Committee and Sets Report Deadline

SEBON issued an official press statement confirming that it has taken the technical failure at Data Hub Pvt. Ltd. with utmost seriousness. The newly formed five-member technical inspection team will inspect the affected data center, assess vulnerabilities in the network, and submit actionable recommendations to prevent future cyber incidents.

In addition to forming the inspection team, SEBON directed NEPSE and relevant market authorities to submit a comprehensive investigation report by Ashwin 12 (September 28). The report must detail:

• The exact cause and vector of the ransomware breach.

• Systemic vulnerabilities within the Data Hub server architecture.

• Preventative protocols and cybersecurity frameworks to safeguard future trading.

Timeline of the Ransomware Attack on Data Hub

Data Hub Pvt. Ltd., the primary data center hosting trading servers for 72 brokerage companies, detected the ransomware intrusion around 5:30 AM on Sunday.

Advertisement

Fortunately, a full system backup was successfully completed at 4:00 AM on Sunday—just 90 minutes before the ransomware was detected. This backup remained completely isolated and uncompromised. To prevent lateral movement of the malware, affected systems were immediately disconnected from external networks to facilitate forensic investigation and clean restoration.

Broader Impact on Nepal’s Financial Market

The cybersecurity breach extended beyond individual broker systems, temporarily impacting interconnected services including:

Trade Management System (TMS): Online order execution and real-time trade matching were completely paralyzed across 72 brokerages.

CDSC & Clearing Systems: Settlement workflows managed by CDS and Clearing Limited experienced immediate operational halts.

Integrated Payment Gateways: Automated digital fund transfers between bank accounts, brokers, and clearing clearinghouses faced preventive isolation.

Nepal’s capital market holds equity assets belonging to roughly 8 million investors, with a total market capitalization exceeding Rs 45 Kharba. The temporary paralyzing of core infrastructure highlights urgent gaps in data center redundancy, disaster recovery planning, and network isolation across the national stock trading ecosystem.

Next Steps for NEPSE, SEBON, and Market Recovery

SEBON emphasized its commitment to reinforcing the resilience, security, and transparency of Nepal’s securities market. The regulatory body is reviewing standard operational guidelines for third-party infrastructure providers hosting critical financial infrastructure.

As forensic teams work alongside Data Hub engineers to sanitize servers and verify data integrity using the 4:00 AM backup, investors await formal restoration updates from NEPSE and the final investigation findings due on September 28.

For more: SEBON Investigates Suspension of Share Trading