On Monday, 21 September 2026, Nepal's stock market did not open. Not because of a circuit breaker, not because of a public holiday. A ransomware attack had locked 72 of the country's 90 brokerage firms out of their own trading terminals, and for one full day the Nepal Stock Exchange stood silent.
No index crashed. No sector collapsed. This was not a price event at all. It was an infrastructure event, and arguably a more important one. Markets are built on pipes: trading systems, depositories, clearing networks. When the pipes fail, everything riding on them stops. The uncomfortable part of this story is how little it took.
The attack targeted Data Hub Pvt Ltd, a private data center in Thapathali that hosts the Trading Management System infrastructure used by 72 Nepali brokers. The TMS software itself was built by YCO Pvt Ltd; Data Hub manages the backups and infrastructure it runs on. Here is the detail that reframes the whole incident: NEPSE's own online trading engine was never breached. The ransomware struck the terminals and infrastructure around the exchange, not its core system. One private facility serving as the operational backbone for 80% of the country's brokers was enough. That is the textbook definition of a single point of failure.
It is not hard to see how it happened. Brokers converged on one shared TMS provider because it was standard and convenient. Convenience compounds into dependency, and dependency becomes systemic risk. Major exchanges elsewhere run geographically separate disaster-recovery sites with tested failover. Nepal's broker ecosystem, as the week revealed, had no equivalent redundancy.
About 18 brokers used separate data centers and could theoretically have kept trading. NEPSE closed the entire market anyway, and both reasons deserve attention. The first was fairness: letting 18 brokers trade while 72 sat locked out would have created a two-tier market, some investors able to execute and most not. Exchanges exist to be neutral ground; the moment access becomes unequal, the playing field itself is broken. The second was contagion risk. NEPSE's trading system shares a network with the compromised data center, and the intrusion had shown signs of touching connected services, including depository, clearing, and payment gateways. Trading on while ransomware was live elsewhere on that network carried cybersecurity, operational, and data-theft risk. Shutting down isolated the blast radius. It was the conservative call.
What was at stake sharpens the picture. Reports citing market media estimated the data of roughly 8 million investors was in the blast radius, in a market valued at around Rs 4.55 trillion: TMS servers, depository and clearing records, payment gateway logs. Whether any sensitive investor data was actually exfiltrated before the systems went offline was still under forensic examination at the time of writing, and that is the question with the longest tail.
The timeline is worth laying out plainly. The intrusion was detected at around 5:30 AM on Sunday, 20 September. Trading was suspended on Monday the 21st. The market reopened on Tuesday the 22nd on the normal 11 AM to 3 PM schedule. What made restoration possible was genuine operational luck: Data Hub had completed a full system backup at around 4:00 AM that Sunday morning, about 90 minutes before detection, and stored it separately from the main network. Had that backup been on the same network, this story would be considerably darker.
The shutdown also revived a longer-running debate about who owns and runs the exchange. NEPSE is 89.39% owned by the state and its institutions: the Government of Nepal holds 58.66%, Rastriya Banijya Bank 11.23%, the Employees Provident Fund 10%, and Nepal Rastra Bank 9.51%, with private brokers holding a fraction of a percent. The chief executive post was vacant through the shutdown week; on September 28, 2026, the Cabinet appointed Chudamani Chapagain as CEO, and he received his appointment letter the same day. A restructuring proposal aimed at professionalizing the exchange has been pending at the Ministry of Finance for nearly two years, still not acted upon. A market's resilience is partly technological and partly institutional: the people and governance structures empowered to fix things before and after they break. On both fronts, the week left questions on the table.
The Securities Board of Nepal has formed a five-member inspection committee led by an Executive Director to investigate the root technical causes, review security protocols, and recommend preventative measures. NEPSE and the relevant market authorities have been directed to submit a comprehensive report by Ashwin 12 (28 September 2026). That report matters more than the closure itself, and whether its recommendations get implemented matters most of all.
For investors, a few practical lessons, stated without hype. Operational risk is a real risk class: we price market risk and credit risk, while infrastructure failure rarely makes it into the mental model until it does. Keep your own records: maintain independent copies of your holdings and transactions, because your broker's TMS should not be the only copy of your financial life. And don't let closures drive decisions: on Tuesday the index gained 7.06 points to close at 2,654.28, turnover of Rs 7.05 billion exceeded the previous session's Rs 6.74 billion, and of 356 securities traded, 137 gained and 131 fell. An ordinary day. Calm, not panic, is what the data shows.
The reassuring part of this story is that the pipes held: the backup survived, the market reopened, confidence didn't crack. The troubling part is how little stood between a single data center and a national market shutdown. Infrastructure resilience is not exciting work, until the day it becomes the only work that matters.
This article is published for research and education purposes only. It is not investment advice, and nothing here should be read as a recommendation to buy, sell, or hold any security. Figures cited reflect publicly reported information at the time of writing and may be revised as investigations proceed.