Ransomware attack on Data Hub forces stock market to halt trading

A ransomware attack on the data center hosting 72 stockbrokers has forced NEPSE to suspend trading amid ongoing cybersecurity and data-integrity concerns.

The stock market remained closed on Monday after a ransomware attack disrupted the data center hosting the trading systems of 72 stockbrokers.

The attack targeted the infrastructure of Data Hub, the data centre company where the systems of the affected brokers are hosted. The incident was detected early Sunday, leaving the brokers unable to operate their trading systems normally.

The Nepal Stock Exchange (NEPSE) suspended trading after receiving a request from the Stock Brokers Association of Nepal, which cited concerns over cybersecurity, data security and operational risks.

Data center hit by ransomware

Data Hub has confirmed that its infrastructure was affected by a ransomware attack. The company informed YCo, another firm that which manages the trading systems of stockbrokers, the incident.

According to Data Hub, the attack was detected at around 5:30 am on Sunday. The company said it had taken a complete backup of its systems around 4 am, before the attack was detected, and that the backup remains secure and isolated.

However, the affected systems have been taken offline as a precaution against the ransomware spreading to other interconnected networks. Data Hub said forensic analysis and other security measures are being carried out before the systems can be brought back online.

The identity of the ransomware group behind the attack has not been disclosed. It is also unclear whether the attackers demanded a ransom or whether any data was stolen.

TMS, clearing and payment systems affected

YCo informed the Stock Brokers Association that the incident had affected several interconnected systems and services, including the Trading Management System (TMS), systems related to CDS and Clearing, payment gateways and other services.

YCo also warned that the data center’s network connectivity with NEPSE could expose the broader trading ecosystem to cybersecurity and data-integrity risks.

With the extent of the incident still under assessment, continuing market operations could potentially create additional risks, the company said.

Why did NEPSE suspend trading?

The Stock Brokers Association requested NEPSE to halt trading as a precautionary measure after the brokers’ systems became unavailable.

NEPSE said the data center hosting the servers of 72 trading-member companies had been experiencing technical problems since Sunday morning and that the issue had not been resolved.

The exchange said continuing trading under the circumstances could potentially expose its own trading system to damage.

As a result, NEPSE announced the suspension of trading for Monday. It remains unclear whether the stock market will reopen on Tuesday.

The affected systems are still being kept isolated while Data Hub carries out forensic investigations and assesses the extent of the cyberattack. Authorities and market participants will need to determine whether the systems are sufficiently secure and stable before normal trading can resume.