Nepal's Digital Services Face Data Exposure, Market Disruption and Gaps in Accountability

135 government email accounts expose a wider security problem

At least 135 email accounts under Nepal's nepal.gov.np government domain were identified in external data breaches after the National Cyber Security Centre joined Have I Been Pwned, a service that tracks exposed credentials. The affected addresses included accounts associated with the Prime Minister's Office and the ministries of Home Affairs, Finance and Foreign Affairs.

The discovery sits alongside reports of exposed student and faculty documents, attacks on government portals, interference with electronic procurement and a ransomware incident that interrupted stock trading. Accounts published in October 2026 describe a digital administration whose security failures can affect both personal privacy and access to essential services.

These incidents involve different problems. An email address appearing in a breach does not, by itself, prove that someone entered a government network. A website being taken offline does not establish that its records were stolen. Yet exposed credentials, weak access controls and dependence on shared infrastructure can combine to create routes into more sensitive systems.

Nepal is connecting passports, identity verification, taxation, banking and social security to digital services while citizens continue to report queues, delayed identity cards and unavailable servers. The central issue is therefore broader than stopping hackers: the government must protect information it requires people to submit while keeping services usable when a component fails.

What the email discovery establishes

Nepal became the 47th government entity to join Have I Been Pwned, according to National Cyber Security Centre Director Raj Kumar Maharjan. The connection gives the centre a way to identify government addresses exposed through breaches elsewhere, rather than relying solely on evidence from its own networks.

Maharjan said the centre would notify affected departments and require password changes. He explained how the monitoring service changes the response:

Through this portal, our centre now receives precise details regarding which email address was leaked and from which source. This allows us to alert relevant officials in real time, enforce immediate password resets, and prevent further damage.

The figure of 135 should not be read as a count of confirmed intrusions into 135 government mailboxes. Public reporting does not establish how many accounts remained vulnerable, whether exposed passwords were still valid, or how many had additional authentication protection.

Cybersecurity expert Mona Nyachhyon warned that compromised official accounts can threaten internal networks and confidential communications. An attacker who controls a real government mailbox can also make fraudulent requests appear credible, especially when recipients recognise the address.

Separate accounts describe credentials associated with Agriculture Development Bank appearing through malware that steals information from infected devices. Such theft can happen at the computer used to access a service, without requiring an attacker to break directly into the service's central server.

Citizen documents and public portals face different threats

The University Grants Commission's online system reportedly exposed citizenship documents, educational certificates, bank account details and Permanent Account Number records belonging to professors and students. Changing a web address was reportedly enough to reach documents because access controls were missing.

Access control is the check that determines whether a person is permitted to view a particular record. A document is not protected simply because its address is difficult to guess. The server must verify permission every time someone requests it.

Reports also describe unauthorised access to the public application programming interface of the government cloud portal. An interface, commonly called an API, allows software systems to exchange information or perform actions. Groups identified as PSy404 and AnoNagoSt, associated with the ForceAnon network, allegedly used that access to post messages and images.

Other reported incidents include vulnerabilities disclosed by Midnight Ops Nepal in systems such as the Department of Hydrology and Meteorology, and access to ministry administration panels attributed to FunkSec. Budget and municipal documents were allegedly offered for sale.

These claims require separate assessments. Posting material through a public interface demonstrates a control failure, but does not establish access to every database hosted in the government cloud. Reports of documents offered for sale also need verification of their authenticity, scope and origin before the full exposure can be measured.

A timeline of reported attacks and government action

The accounts describe incidents across several years rather than a single coordinated attack. The sequence also shows that the creation of a dedicated cyber centre did not end disruptions.

• 1 January 2024: A distributed denial of service attack reportedly disrupted public service websites and applications, with effects lasting weeks.
• 23 January 2024: The Cabinet decided to establish the National Cyber Security Centre, which became operational later that spring.
• December 2024: Attacks were reported against government portals in Gandaki, Lumbini and Bagmati provinces.
• February 2025: Reports described attacks on 21 Koshi Province subdomains.
• March 2025: The Hello Sarkar complaint platform's database was reportedly compromised and offered for sale.
• April 2025: Approximately 2 million citizenship records submitted for police reports were allegedly stolen from a Nepal Police website and offered for sale.
• 13 May 2026: Published amendments to the Government of Nepal Business Allocation Rules reportedly transferred key technology bodies to the Prime Minister's Office.
• September 2026: An alleged ransomware attack disrupted systems serving 72 stock brokerages and stopped trading for a day.
• Early October 2026: Pathao Nepal reportedly acknowledged a leak involving user names, email addresses and phone numbers.

The alleged theft of roughly 2 million police records is among the largest exposures described. That number is a reported claim, not an independently established count of affected individuals. The accounts do not give a verified breakdown of unique records or a complete public assessment of the damage.

Electronic procurement brings security into public spending

The reported compromise of the electronic government procurement system, known as e-GP, concerns the integrity of public contracts as well as confidential information. The Public Procurement Monitoring Office operates the platform for bidding on government work worth billions of rupees.

Investigators reportedly found that unauthorised users could view competitors' confidential bid amounts and alter figures after submission deadlines. Accounts describe alleged cooperation between hackers, intermediaries and contractors, including cryptocurrency payments and a counterfeit procurement website.

The Nepal Police Central Investigation Bureau reportedly arrested more than 20 people, including a former minister, construction business figures and technical employees, and brought cases to court. Arrests and charges are not convictions. The reporting does not provide final judgments establishing each accused person's responsibility.

Security concerns reportedly prompted the suspension of electronic bidding and a return to sealed paper bids for essential procurement. The accounts give no confirmed restoration date.

The distinction from a document leak is crucial. Confidentiality fails when someone sees a bid they should not see. Integrity fails when someone changes the bid itself. If either protection breaks down, a digital system intended to make procurement more transparent can instead give an undisclosed advantage to selected bidders.

One provider can interrupt an entire market

A September 2026 ransomware incident allegedly struck a private data centre hosting trading management systems for 72 brokerage companies. Trading at the Nepal Stock Exchange was reportedly unavailable for a full day. The original account also describes government information being hosted at the affected facility.

Ransomware typically blocks access to systems or data, often by encrypting files, and demands payment. The reporting does not establish the attack's technical mechanism, whether information was also stolen, or whether any ransom was paid.

The more firmly described consequence is operational: a disruption at one hosting provider spread across dozens of brokers and prevented investors from trading. This is concentration risk, where many organisations depend on the same supplier or infrastructure.

The Pathao Nepal disclosure presents a different private sector exposure. Names, email addresses and telephone numbers reportedly leaked in early October 2026. Reports describe thousands of affected users but do not provide an exact verified total.

Earlier accounts also mention customer information leaks involving Vianet and Foodmandu, attacks involving bank ATM systems, and an attempted attack on NIC Asia Bank's SWIFT system. These incidents differ in scope and outcome, but show that the security challenge extends beyond government websites to services used for communication, shopping, transport and finance.

National identity capacity problems spread across services

The national identity system illustrates how a service can fail without a confirmed cyberattack. Reports attribute weeks of interrupted authentication to technical pressure when the biometric system approached a capacity of about 20 million records.

More than 16 bodies reportedly experienced disruption, including passport, tax, transport and banking services. The figure describes the system's reported capacity pressure, not a verified count of people whose biometric information was exposed.

The accounts differ in their description of the French supplier's corporate identity. The original account refers to a transition from Idemia to IN Groupe, while another account repeats IDEMIA as the current name. The precise contracting and support arrangements are not established here. The operational issue is the same: several services relied on one authentication platform and were affected when it became unavailable.

A shared identity service can reduce repeated checks and paperwork. It also becomes a single point of failure if agencies cannot proceed through a safe alternative when that service stops responding. Capacity planning, recovery arrangements and clear supplier responsibilities therefore matter alongside protection against intruders.

The privacy consequences require equal care. Fingerprints are biometric identifiers; citizenship numbers and birth dates are identity information, not biometrics. Unlike a password, a fingerprint cannot simply be replaced. Exposure of these details can create lasting opportunities for impersonation and targeted fraud.

Government defences are expanding, with limits

The National Cyber Security Centre reportedly audited nearly 40 government systems during the four months preceding the email breach report. It also uses CTM360, a monitoring tool provided by the International Telecommunication Union, to track illicit exchanges involving government information.

A newly purchased Security Information and Event Management system collects and analyses activity logs across government networks. Such tools help staff identify suspicious patterns, but their value depends on what is monitored and how quickly teams investigate alerts.

Prakash Duwadi, identified in the Nepali account as information officer at the Information Technology and Electronic Governance Office, said hosted government portals can face 7,000 to 8,000 attack attempts simultaneously. He estimated that basic testing by students or children accounts for 10 to 20 percent of attempts. The reporting does not explain the measurement period or counting method.

Duwadi also said staff sometimes disconnect systems when they cannot defend them safely. A server outage may therefore be a protective action rather than evidence that attackers have taken control. Citizens still lose access either way, making accurate service notices and recovery procedures necessary.

Maharjan attributed more than 90 percent of cyber incidents to human behaviour and social engineering. That is his stated assessment, rather than a documented national statistical finding. He also warned that rapidly building applications with artificial intelligence can leave developers unaware of weaknesses in encryption and security.

Reported phishing messages have impersonated Additional Inspector General Manoj Kumar KC, the Prime Minister's Office and other police officials. They threatened prosecution to pressure recipients into replying or disclosing information. These examples show how fear and official authority can become tools of fraud.

Privacy rights need visible enforcement

Article 28 of Nepal's Constitution protects privacy. The Privacy Act, 2075 (2018), also sets duties concerning personal information held by public bodies. The original account and accompanying analysis identify Section 29 with penalties of up to three years in prison, Section 31 with compensation, and Section 32 with departmental action.

Those provisions do not establish that every reported technical failure meets the conditions for a criminal offence or compensation. Responsibility must be determined from the conduct involved, the applicable legal provisions and the evidence. Public reporting gives little detail about penalties or compensation arising from the incidents discussed.

Administrative responsibility is also changing. Amendments published on 13 May 2026 reportedly moved the Cyber Security Centre, Data Management Centre and Department of Information Technology to the Prime Minister's Office. A Cabinet agenda approved on 27 March 2026 called for an Information Technology and E-Governance Office within three months, but organisational surveys were reportedly incomplete when the account was published.

The resulting structure and reporting hierarchy remained unsettled. Moving institutions does not itself establish who must notify affected citizens, approve the restoration of a compromised service or verify that a supplier has corrected a security defect.

Testing, procurement and disclosure are the next decisions

The original analysis proposes making security obligations part of software procurement from the start. These include encryption, continuing updates, maintenance and quality and cost based selection, rather than treating software as a purchase finished at delivery. These are proposals, not confirmed new government requirements.

It also argues for mandatory vulnerability assessment and penetration testing before services open to citizens. These tests identify weaknesses and attempt controlled intrusions. Completing a test is different from correcting its findings: a credible launch decision requires evidence that serious defects were fixed and checked again.

Cybersecurity specialist Naresh Lamgade says security is often omitted during development and private researchers are discouraged from reporting vulnerabilities. A clear reporting channel, with defined handling procedures, would help turn discoveries into repairs rather than leaving researchers uncertain about approaching an agency.

Other proposed measures include additional authentication for government email and administrative accounts, regular data centre audits, notification of affected citizens after breaches, and an independent data protection regulator. The reporting gives no confirmed adoption dates for these measures.

The immediate unanswered questions are specific: how many exposed accounts have been secured, whether alleged stolen datasets have been authenticated, when electronic bidding will resume, and how identity services will avoid another capacity interruption. Public answers would make it possible to judge recovery by results rather than the number of services placed online.

Key Points

• At least 135 government email accounts were identified in external breaches after Nepal joined Have I Been Pwned.
• Reported exposures include university documents and approximately 2 million police report citizenship records, with the latter total still unverified.
• More than 20 people were reportedly arrested in the electronic procurement case; final court outcomes are not given.
• An alleged September 2026 ransomware incident disrupted systems serving 72 brokerages and stopped stock trading for a day.
• National identity capacity problems reportedly interrupted authentication for more than 16 bodies for weeks.
• Security monitoring and testing have expanded, but breach notification, responsibility and several recovery dates remain unresolved.