Nepse rebounds 2.13% after Dashain as ransomware risk lingers

A phone call and an email reached the Nepal Stock Exchange at 5.30 am on Sunday, 20 September 2026, a public holiday. A data centre serving brokers had been hit by ransomware. The market was already closed, and the exchange chose the next morning to isolate its systems and suspend trading.

The same market has since rallied. In the trading week of 26 to 30 October 2026, the first after the Dashain holiday, the Nepse index rose 55.98 points, or 2.13%, to 2,690.15. The two stories belong together. A market that attracts fresh money has to show it can be trusted to hold it.

A rally with questions attached

Weekly turnover jumped 52.64% to Rs 34.39bn from Rs 22.53bn in the preceding week, an average of Rs 6.88bn a day. Market capitalisation rose by Rs 100bn to Rs 4.63 trillion, about $30.4bn at the central bank's rate of Rs 152.23 to the dollar. myRepublica put the gain to investors at Rs 96bn, a different measure from the capitalisation figure.

Gains came in every major sector, but not evenly. Hydropower led, while insurers and microfinance lagged.

1. Hydropower3.78%
2. Others3.23%
3. Development banks2.61%
4. Commercial banks2.32%
5. Life insurance1.06%
6. Microfinance0.97%
7. Non-life insurance0.18%

Source: Weekly sector data

The laggards have reasons. Non-life insurers are expected to book heavy flood and landslide claims, leaving little room for dividends this year. Microfinance companies are struggling with rising non-performing loans, and many are unlikely to pay dividends either.

Speculation sits beside substance

The spread of the rally invites caution. Beni Hydropower Project rose 101.05% to Rs 709.70. Mathillo Mailun Khola Hydropower rose 14.51% and Lumbini Bikas Bank 13.31%. On the other side, Chirkhwa Hydropower lost 15.15%, and Unilever Nepal fell 3.91% to Rs 48,001.

Turnover tells a second story. Ghalemdi Hydro topped both turnover and volume with Rs 1.44bn traded, followed by Green Ventures at Rs 1.01bn and Shivam Cements at Rs 935.7m. Commercial banks also featured prominently by volume: Kumari Bank traded 2.93 million shares, Nepal Investment Mega Bank 2.48 million, Laxmi Sunrise Bank 2.14 million and Global IME Bank 1.81 million. Large, liquid banks are drawing steady interest while small hydropower names produce the sharpest moves.

Analysts disagree on what this means. Manish Aryal reads the rise in both index and volume as improving sentiment, and says institutional investors appear to be accumulating stronger banks and selected hydropower stocks. He also cites aggressive margin lending by brokers, meaning loans that let investors buy more shares than their cash allows. He sees the index approaching 3,000, with periodic corrections.

Ajay Singh Thapa calls it a routine rebound from a low level. Corporate results have improved but remain weak, he says, and the wider economy is underperforming. He expects about another 200 points before a decline.

The two views are not far apart. Both expect more upside in the near term, and they differ on whether anything durable stands behind it. Prices that rest on liquidity and borrowing, rather than on better earnings, tend to be fragile when borrowing costs or sentiment shift.

What the charts say

Technical indicators are firm but stretched. The index has moved above its 20-day and 50-day exponential moving averages, around 2,621 to 2,627. Resistance sits at 2,689 to 2,690, almost exactly where the index closed. The Relative Strength Index, a gauge of how quickly prices have risen, stood at 69.54, just under the common overbought threshold of 70. If support near 2,621 to 2,627 fails, the next level is around 2,580.

The outage behind the rally

The cyberattack is the quieter risk. The target was Data Hub, whose servers carried the trading systems of 72 brokerage firms. Trading was suspended on 21 September 2026. Data Hub did not pay a ransom. It deleted the encrypted data, added security measures and restored records from backups at its disaster recovery centre in Butwal, and trading resumed the following day, a Data Hub official said.

1. 120 September 2026: Data Hub tells NEPSE of the attack at 5.30 am
2. 221 September 2026: NEPSE isolates the TMS network and halts trading
3. 3Data Hub wipes encrypted data, restores from Butwal backups
4. 4Trading resumes the following day

Source: Exchange report

The Securities Board of Nepal (SEBON), the market regulator, gave NEPSE a week to report on prevention. A SEBON official called the result largely superficial, and suggested the short deadline was the reason. The report recommends mandatory minimum cybersecurity standards, regular IT audits, vulnerability testing every three months, real-time or regular backups kept separately, multi-factor authentication and staff training.

A NEPSE official raised the structural point. Brokers pay monthly fees to outside providers rather than build their own systems, and with 72 firms on one host, a single incident shut the entire market. Spreading the load across several providers, the official said, would limit the damage.

SEBON chairperson Gopal Prasad Bhatta says an IT policy for the capital market is nearing completion and will absorb NEPSE's recommendations.

What to watch

First, whether the index clears resistance near 2,690 or retreats toward 2,621 to 2,627. Second, first-quarter results from the banks, which will test the belief that earnings justify the buying. Third, whether retail investors return after Tihar, as Aryal expects, and how far broker margin lending grows.

Finally, the content of SEBON's IT policy. If it turns recommendations into binding standards, and discourages dependence on a single host, it would address the weakness the September 2026 outage exposed. If it does not, the market has widened its investor base while leaving its single point of failure in place.