Trading on the Nepal Stock Exchange (NEPSE) had to be suspended on September 21 after a ransomware attack on a data centre disrupted the trading systems of 72 brokerage firms hosted by Data Hub.
A ransomware attack can block access to brokers’ trading systems, client details and other data required to conduct transactions. Hackers gain access to servers, encrypt files and change their extensions, making them inaccessible even though the data remains stored on the server.
In such attacks, hackers typically demand a ransom in exchange for the key needed to unlock the files. Data Hub, however, chose not to pay. Instead, it deleted the encrypted data, introduced additional security measures and restored the information from backups held at its disaster recovery centre in Butwal.
The move enabled trading to resume the following day, a Data Hub official said.
Following the attack on Data Hub’s infrastructure, the Securities Board of Nepal (SEBON) directed NEPSE to submit a report within a week outlining improvements to prevent similar incidents.
NEPSE has since submitted its report, but a SEBON official described the recommendations as largely superficial and insufficient to provide concrete solutions.
“Perhaps because NEPSE was given only a week, its recommendations for improving cybersecurity are superficial,” the official said.
The report outlines information received after the attack, measures taken to prevent risks to other systems and steps needed to reduce the likelihood of similar incidents.
According to the report, Data Hub informed NEPSE of the attack through email and telephone at 5.30 am on September 20. Since it was a Sunday and a public holiday, the stock market was already closed.
The following morning, NEPSE coordinated with the concerned parties and decided to suspend trading to prevent further risks. The report says the decision was taken because connecting the Trade Management System (TMS) network to NEPSE’s system posed an immediate security risk.
“From a security perspective, connecting the TMS network to NEPSE’s system at that point posed a risk, so the systems were isolated,” the report states.
The report also notes that Data Hub restored the data using backups stored at its disaster recovery centre. The company said transaction records up to Friday had been safely backed up there.
NEPSE has recommended that minimum cybersecurity standards be made mandatory to prevent similar incidents in the future.
Its recommendations include regular information technology audits of computer systems, software, servers and other digital infrastructure. All users connected to the capital market, it says, must follow minimum cybersecurity standards.
The report also recommends vulnerability testing every three months to identify security weaknesses in computer systems, software, servers and networks.
It calls for regular or real-time data backups, ensuring that important information is copied to a separate, secure location at fixed intervals or whenever changes are made. This would allow data to be recovered if the main system fails.
Backups should be kept separate from the main system, protected against unauthorised access and maintained in a form that allows information to be recovered when needed.
NEPSE has also recommended multi-factor authentication, which requires users to verify their identity through more than one method, for certain systems.
Other suggestions include cybersecurity training for employees of SEBON, NEPSE and related companies; using licensed antivirus software to conduct full scans of office computers and laptops; and avoiding suspicious messages received through email or other channels.
“Some of these recommendations may appear minor, but such small improvements can help reduce the risk of major cyberattacks,” a NEPSE official said.
The official also <a href="https://bitcomme.com/use-ldc-deferment-to-diversify-exports-raise-productivity-2/” title=”Use LDC deferment to diversify exports, raise productivity”>raised concerns about the current practice of outsourcing critical infrastructure. Rather than maintaining their own trading systems, data storage and backup facilities, brokerage firms often pay other companies to provide these services.
This arrangement, the official said, increases the risk of disruption.
“If the data of 72 brokerage firms were not hosted by a single company, but instead distributed among several providers or managed through infrastructure maintained by the brokers themselves, an incident would affect only a limited number of firms. The entire stock market would not have to be shut down,” the official said.
However, brokerage firms have found it more convenient to pay monthly fees to service providers than to invest in their own infrastructure, the official added.
Some brokers outsource their trading systems to one company while relying on another for data storage and backups.
SEBON preparing IT policy for the stock market
The Securities Board of Nepal is preparing an information technology policy for the capital market, incorporating NEPSE’s recommendations and suggestions from IT experts working with the board.
“We are preparing an IT policy that reflects current needs. It will apply to the securities market, market participants, the board and companies technically connected to the sector,” said SEBON Chairperson Dr Gopal Prasad Bhatta.
IT experts at the board are currently working on the policy, which is nearing completion, Bhatta said.
“The policy will provide guidance on all technical aspects related to the capital market,” he said.
According to Bhatta, the new policy will also incorporate issues raised in NEPSE’s recent report on improving technical security in the capital market, as well as shortcomings identified in the past.
