Cybersecurity for Nepali SMEs: what recent breaches teach

Most breaches at Nepali small businesses don't need a clever hacker. They need one reused password, one unpatched plugin or one backup nobody tested. Ten basic controls, most of them free, would have blunted nearly every incident on this page. The hard part is doing them consistently, not buying anything.

Nepal has had a busy few years. On 20 September 2026, a ransomware attack on DataHub, a data centre that hosts the trading systems of 72 brokerage firms, took those systems down, and the Nepal Stock Exchange halted trading the next day at the brokers' request. A month earlier, Nepal's National Cyber Security Centre joined the Have I Been Pwned breach tracker and found at least 135 official government email addresses in leaked data. Those aren't SME stories, but the causes behind them are exactly the ones that hit small firms.

What have Nepal's notable breaches actually looked like?

Look at the public record and a pattern shows up. Very few incidents were exotic. Most came down to access that was too easy to get, systems that weren't patched or separated, or recovery that depended on luck.

• October 2017, NIC Asia Bank: attackers sent fraudulent SWIFT transfers during Tihar, about $4.4 million in total, most of which was later recovered. The Kathmandu Post reported that the SWIFT computers were also used by IT staff for everyday tasks such as personal email.
• March 2020, Foodmandu: a leak of about 50,000 users' names, phone numbers, addresses and emails was posted publicly, according to myRepublica. The company said it fixed the flaw.
• January 2023, the Government Integrated Data Centre: a distributed denial-of-service attack knocked around 1,500 government websites offline and stalled immigration systems at Tribhuvan International Airport for about three and a half hours. Officials said no data was compromised.
• September 2025, the Gen Z protests: fires destroyed the Department of Transport Management's server and archives, while bodies with offsite backups, like the Supreme Court, could restore. The government data centre's disaster-recovery site in Hetauda stayed intact.
• August and September 2026: the 135 leaked government email accounts, then the DataHub ransomware attack that stopped share trading.

None of these reports names a confirmed culprit in a way we'd repeat here, and it doesn't matter for a business owner. What matters is the lesson each one carries: separate critical systems, patch what faces the internet, protect logins, and keep a copy of your data somewhere a fire or a ransomware gang can't reach.

Why is this a bigger risk for Nepali SMEs now?

Because the scams have moved to where customers already are. Nepal Police's Cyber Bureau registered 20,526 cybercrime complaints between mid-July 2025 and mid-July 2026, myRepublica reported in August 2026. Most involved social media, but 744 were about digital payments and bank accounts, including eSewa, Khalti and SMS fraud, and 846 involved organisations. Fake parcel, lottery and job messages were among the patterns police flagged.

The policy side has also caught up. The cabinet endorsed the National Cyber Security Policy 2080 in August 2023, which set up the path for new laws and standards. Nepal Rastra Bank's Cyber Resilience Guidelines, enforced from August 2023, already apply to banks, payment service providers and payment operators. If you're a vendor or a merchant connected to them, expect their security questions to land on your desk. And if customer data leaks, your duties under the Privacy Act kick in, which we covered in Nepal's Privacy Act and your CRM, chatbot and AI tools.

How do attackers actually get in?

Verizon's Data Breach Investigations Report is the largest public dataset on this. Its 2026 edition, published in May, found that exploiting a software vulnerability was the top way in for the first time in the report's 19 years, at 31% of breaches, up from 20% a year earlier. Phishing was 16%. Stolen credentials fell to 13% as a first step, partly because Verizon started tracking pretexting separately, but credential abuse still appeared somewhere in 39% of breaches. Ransomware showed up in 48% of breaches, and third parties were involved in close to half.

Read that chart as a to-do list. Patching handles the tallest bar. MFA and a password manager handle the credential problem. Awareness training reduces the phishing share. Vendor hygiene covers the third-party half.

How does a typical SME breach unfold?

Here's the chain we see most often in small firms. A staff member gets a convincing message, perhaps a fake bank or eSewa alert in Nepali, and types their email password into a lookalike page. The attacker logs into the mailbox, reads invoices, and sets a hidden forwarding rule. From there they either send a customer a 'new bank account' for payment, or use the same password on the cloud admin console, turn off backups and run ransomware. Tap each step below to see which control breaks it.

Which 10 controls stop most SME breaches?

You don't need to invent a framework. The UK's Cyber Essentials scheme boils small-business security down to five technical controls: firewalls, secure configuration, user access control, malware protection and security updates. The US CISA's Cyber Essentials and the CIS Controls Implementation Group 1, which is 56 safeguards aimed at small, resource-limited teams, say much the same thing. We've squeezed them into ten items a Nepali SME can actually do, with rough effort and what each one stops.

What does each control look like in practice?

• MFA everywhere, starting with email and the cloud or hosting admin account. Use an authenticator app, not SMS, for admins.
• A business password manager so every login is unique and shared credentials are stored, not pasted into chats.
• Automatic updates on laptops, phones, routers and servers, with a monthly check for anything that failed.
• 3-2-1 backups: three copies, on two kinds of storage, one offsite or immutable. Restore one real file every quarter.
• Least privilege: daily work on normal accounts, admin rights only where needed, and a separate admin login.
• Ten-minute phishing talks using real local examples, like a fake Nepali-language bank or eSewa SMS, and a rule to call back before changing any payment detail.
• Offboarding on the last day: disable accounts, rotate shared passwords, pull devices. Kill generic logins such as 'accounts@' that five people share.
• Website hygiene: update WordPress core and plugins, delete what you don't use, and put MFA on the admin panel.
• Secure configuration: change default passwords and close admin ports and panels that face the internet.
• Logging and alerts on new sign-in locations, new mailbox forwarding rules and admin changes, kept for at least 90 days.

Where should a small team start this month?

Do it in order of cost to the attacker. Week one, MFA on every email and admin account and a quick look at who still has access. Week two, turn on automatic updates and clean up the website plugins. Week three, set up the offsite backup and actually restore something from it. Week four, alerts and a short phishing talk with the team.

Where your servers live matters less than how they're run. We compared local and global hosting in Hosting from Nepal: local data centre vs AWS, Azure, GCP; the DataHub case is a reminder that concentrating many businesses in one provider also concentrates the risk. If your systems need to stay up through an incident, our high-availability re-architecture blueprint shows how redundancy and tested recovery fit together. And security logging doesn't have to blow up your bill; the same tagging and alert habits from FinOps for small teams apply.

How can NeuralYug help?

We set up and run cloud infrastructure for Nepali and international teams, and these ten controls are the baseline we put in place on every project. If you'd like a plain-language check of where your business stands, talk to us or see our cloud and DevOps service.