The incident has ignited widespread outrage among investors and market participants, placing the spotlight squarely on NEPSE's administrative efficiency, cybersecurity protocols, and the efficacy of its heavily funded Disaster Recovery (DR) system.
Failure of the Disaster Recovery System
According to industry stakeholders, technology vendors and broker houses operating NEPSE’s legacy Total Management System (TMS) have been collecting substantial monthly fees—reportedly exceeding NPR 70,000 per broker—dedicated to maintaining active backup and disaster recovery servers.
Despite millions of rupees being funneled into these safety nets, the DR system failed to kick in automatically when the primary data center was compromised. Critics argue that instead of immediately rerouting transactions through the DR network, NEPSE opted to halt market operations entirely.
Rather than holding vendors accountable for the breakdown, NEPSE issued a notice suspending trading under Rule 21(1) of the Securities Listing and Trading Regulations, 2075, citing potential damage to the trading system—a move market participants have dismissed as an attempt to mask institutional failure.
Qestions Over Market-Wide Shutdown
The total shutdown has also raised eyebrows given that not all broker houses depend exclusively on the affected data hub. Reports indicate that around 25 to 26 brokerage firms operating under alternative setups, such as Digi Hub and independent servers like NASA, experienced uninterrupted system functionality.
Investor rights advocates have criticized NEPSE leadership for penalizing millions of active investors by freezing the entire market, pointing out that alternative arrangements could have allowed unaffected brokers to continue trading safely.
Demands for High-Level Investigation
The incident has exposed deep-rooted vulnerabilities in the country's capital market infrastructure, leaving the wealth of over five million investors tethered to a single vendor's technical stability.
Stakeholders have called upon the Securities Board of Nepal (SEBON) and the concerned ministries to launch an immediate, high-level investigation into the ransomware incident, the failure of the paid DR infrastructure, and the transparency of NEPSE's administrative decisions.
